General

  • Target

    yuzu_install.exe

  • Size

    10.3MB

  • Sample

    230216-2d7hqsca61

  • MD5

    d51d1d2718e3b9eb5651398e61d74327

  • SHA1

    296f84b6c276fe9e91651336de83d3377ffa147b

  • SHA256

    9e894c2620d565949e0d71e181e780ddaccc5b0d2fd70ec674e913ac7549fdcf

  • SHA512

    a5cb4c437ec8a6a7b036c5e4acd9317b5348851b867069e5da0cc1e887a6b29e33e4d0f6c34a55ed1fc9786bd03a6ae39c95df3ae5f0eb41ab66972d38400063

  • SSDEEP

    98304:9Ap0k+ZEtzkBIDW3TFCdsnCDyXOJWvO1pD5i4By2moI3YxkTN1JItXiy+HD:9w3dtDW30jygH7i4fI3YxkZqLy

Malware Config

Targets

    • Target

      yuzu_install.exe

    • Size

      10.3MB

    • MD5

      d51d1d2718e3b9eb5651398e61d74327

    • SHA1

      296f84b6c276fe9e91651336de83d3377ffa147b

    • SHA256

      9e894c2620d565949e0d71e181e780ddaccc5b0d2fd70ec674e913ac7549fdcf

    • SHA512

      a5cb4c437ec8a6a7b036c5e4acd9317b5348851b867069e5da0cc1e887a6b29e33e4d0f6c34a55ed1fc9786bd03a6ae39c95df3ae5f0eb41ab66972d38400063

    • SSDEEP

      98304:9Ap0k+ZEtzkBIDW3TFCdsnCDyXOJWvO1pD5i4By2moI3YxkTN1JItXiy+HD:9w3dtDW30jygH7i4fI3YxkZqLy

    • Downloads MZ/PE file

    • Sets file execution options in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks