MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d5320cd6e4cfc208f6703fff254b6f1363e1afdf7d8e77155549a674fa3a263. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


YTStealer


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d5320cd6e4cfc208f6703fff254b6f1363e1afdf7d8e77155549a674fa3a263
SHA3-384 hash: 312c4325b3e6f90fc62457ef27aafca5dca479d8f8b560eedc5aa917d2ea95f350e5b360953dd18fd069b4d215fcdb81
SHA1 hash: 4a8a6d3a8d94f02194822c2066e11800a518c8d6
MD5 hash: 96ec3efa9bd454550b615df142b08295
humanhash: crazy-william-green-speaker
File name:bebra.exe
Download: download sample
Signature YTStealer
Create hunting rule
File size:4'232'704 bytes
First seen:2022-09-02 12:56:49 UTC
Last seen:2022-09-02 18:42:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9aebf3da4677af9275c461261e5abde3 (25 x YTStealer, 12 x CobaltStrike, 11 x Hive)
ssdeep 98304:nKxZWSv8fBG6l/mNu13T3Gf4fN11cB50kd3SaNkG:cwNbuNii8D1c8
TLSH T10A1633AA7208A585CE9C11B321C27784FEA1CA1DB3CB4F57C0BDBDB5A32A14359954F3
TrID 64.7% (.EXE) UPX compressed Win64 Executable (70117/5/12)
25.0% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.8% (.EXE) OS/2 Executable (generic) (2029/13)
1.8% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter JAMESWT_WT
Tags:exe YTStealer

Intelligence

File Origin
# of uploads :
3
# of downloads :
338
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-09-02 08:48:50 UTC
Tags:
loader stealer raccoon trojan recordbreaker
Link:
https://app.any.run/tasks/9f262d66-d29f-4f68-a549-a27568a1664a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/307430/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.61641539.662.15458.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/6311fe20a7450371f69c67d7/reports/386eb6c5-77f4-4170-b785-a18c9b996004/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
YTStealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d9e28184-7586-46d9-ac6a-9e4cadfc93d9
Result
Threat name:
YTStealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1064068
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected YTStealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 696591 Sample: bebra.exe Startdate: 02/09/2022 Architecture: WINDOWS Score: 84 26 Antivirus detection for URL or domain 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected YTStealer 2->32 7 bebra.exe 2->7         started        process3 dnsIp4 24 goback.delivery 104.21.84.12, 443, 49726 CLOUDFLARENETUS United States 7->24 34 Tries to harvest and steal browser information (history, passwords, etc) 7->34 11 powershell.exe 13 7->11         started        14 powershell.exe 12 7->14         started        16 powershell.exe 12 7->16         started        signatures5 process6 signatures7 36 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->36 38 Queries memory information (via WMI often done to detect virtual machines) 11->38 18 conhost.exe 11->18         started        20 conhost.exe 14->20         started        22 conhost.exe 16->22         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d5320cd6e4cfc208f6703fff254b6f1363e1afdf7d8e77155549a674fa3a263/
Threat name:
Win64.Infostealer.Goback
Create hunting rule
Status:
Malicious
First seen:
2022-08-31 18:00:49 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
16 of 25 (64.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nvjsbtlojt6cbd3hap77evfw6e3d4gx567moo4kvksngot5dujrq._file
Result
Malware family:
ytstealer
Create hunting rule
Score:
  10/10
Tags:
family:ytstealer spyware stealer upx
Link:
https://tria.ge/reports/220902-p6xssageg6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Reads user/profile data of web browsers
UPX packed file
YTStealer
YTStealer payload
Unpacked files
SH256 hash:
b87f0417c42785c55decdcfeb38feb666a0a2339f81e8e13ba6c1db6433d29dc
MD5 hash:
9af5d819bd17ac22f56225ec5511e83c
SHA1 hash:
4037fcc47256054035a8959dffc86251eb02c237
Link:
https://www.unpac.me/results/9c18bafa-e20d-443a-95a6-739d2fd8d4a2/
SH256 hash:
6d5320cd6e4cfc208f6703fff254b6f1363e1afdf7d8e77155549a674fa3a263
MD5 hash:
96ec3efa9bd454550b615df142b08295
SHA1 hash:
4a8a6d3a8d94f02194822c2066e11800a518c8d6
Link:
https://www.unpac.me/results/9c18bafa-e20d-443a-95a6-739d2fd8d4a2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6d5320cd6e4cfc208f6703fff254b6f1363e1afdf7d8e77155549a674fa3a263

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

YTStealer

Executable exe 6d5320cd6e4cfc208f6703fff254b6f1363e1afdf7d8e77155549a674fa3a263

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/307430/
  
URLhaus
https://urlhaus.abuse.ch/url/2289584/
  
Delivery method
Distributed via web download

Comments