Overview

overview

8

Static

static

Yvbhq.exe

windows7-x64

8

Yvbhq.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Yvbhq.exe

  • Size

    65KB

  • Sample

    221129-j758naeg71

  • MD5

    9829cba45d96db58f0898ad58743a474

  • SHA1

    a3f4827d0523dac0c56e91b4538bdcf14c36570f

  • SHA256

    19d2e3e1f912a1fe23399b0a1c150e28e03ef0cff5dfb7d2d532f705769862b5

  • SHA512

    bd4d6431ca4315ad21a1094594ca0cb68a5cca689b64b73876045e468d1ba1c03d6845b444d2936ea50e71438b44ef65fdd74ca22d2339472f2f6e53be90cd8a

  • SSDEEP

    1536:pmV+3Z/ZBJEomaAsurFk5ZjXx+plbfP9HPe0/v7WYPwoMkeT1eK6G:I+JtEomapYFk5ZsFP9HmelqT1N6G

Score
8/10
evasionpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      Yvbhq.exe

    • Size

      65KB

    • MD5

      9829cba45d96db58f0898ad58743a474

    • SHA1

      a3f4827d0523dac0c56e91b4538bdcf14c36570f

    • SHA256

      19d2e3e1f912a1fe23399b0a1c150e28e03ef0cff5dfb7d2d532f705769862b5

    • SHA512

      bd4d6431ca4315ad21a1094594ca0cb68a5cca689b64b73876045e468d1ba1c03d6845b444d2936ea50e71438b44ef65fdd74ca22d2339472f2f6e53be90cd8a

    • SSDEEP

      1536:pmV+3Z/ZBJEomaAsurFk5ZjXx+plbfP9HPe0/v7WYPwoMkeT1eK6G:I+JtEomapYFk5ZsFP9HmelqT1N6G

    Score
    8/10
    evasionpersistenceransomwarespywarestealer

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Stops running service(s)

      evasion

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks