yanluowang | d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c-patched[.]exe

General

Target
d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c-patched.exe
Size 398KB
Sample230425-q89e2aaf96
SHA256 2491ddaa3afe4cf65bbd6f35588bb8e72e561e32d532ee2eea893e1d545268c2
MD5 4db5fcc6b38b003af9c55c45c45ad789
SHA1 f35bc49a8b503bc34cdb43e8a5acd11142b1a6dc
SHA512 66edb5f9b8c18b50ade0530130d8c68204c68f52739b169bf0da0bb303c5b601867dd65c40c8f5c8e18de3f6229e8dae262aef771473b1e5a93be0be1b215b04
SSDEEP 12288:EfaLQyGK6xAa2XgsA1RUa+jE6S3qRTjO0:EwIynXp/O0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

yanluowang

Malware Config

Signatures

Detects Yanluowang ransomware 1 IoCs

resource	yara_rule
sample	family_yanluowang

Yanluowang family
yanluowang

File Explorer

d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c-patched.exe

.exe 398KB

d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c-patched.exe

IMPHASH 380467bc2cc16b8ce64d4802632fe491
SHA256 2491ddaa3afe4cf65bbd6f35588bb8e72e561e32d532ee2eea893e1d545268c2
MD5 4db5fcc6b38b003af9c55c45c45ad789
SHA1 f35bc49a8b503bc34cdb43e8a5acd11142b1a6dc
SHA512 66edb5f9b8c18b50ade0530130d8c68204c68f52739b169bf0da0bb303c5b601867dd65c40c8f5c8e18de3f6229e8dae262aef771473b1e5a93be0be1b215b04
SSDEEP 12288:EfaLQyGK6xAa2XgsA1RUa+jE6S3qRTjO0:EwIynXp/O0
MD5 SHA1 SHA512 SSDEEP

windows x86

Detects Yanluowang ransomware

PE Signature issue

Digest

b3:16:64:d1:d3:aa:8e:73:7e:6a:29:33:a3:5b:ed:88:71:32:7c:59

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=701872,CN=AdClearance Limited,O=AdClearance Limited,L=Dublin,C=IE,1.3.6.1.4.1.311.60.2.1.3=#13024945,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0d:0d:a8:84:0c:1a:95:9d:09:32:47:fa:33:6e:5a:2d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 3, 2021 - Sep 3, 2022

Minor OS version

Major OS version

Entry point

145671

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32FirstW CloseHandle GetLogicalDriveStringsA SetFilePointerEx LocalFree SystemTimeToFileTime GetSystemTime MoveFileW GetDriveTypeW CreateFileA LocalAlloc SetFilePointer FindNextFileA SetFileTime TerminateProcess WriteFile GetCurrentProcess FindFirstFileA Process32NextW GetLastError CreateToolhelp32Snapshot OpenProcess CreateFileW GetCurrentDirectoryA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx GetFileSizeEx GetModuleHandleW GetProcAddress InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime RtlUnwind RaiseException InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetStdHandle GetCommandLineA GetCommandLineW GetACP HeapAlloc HeapFree GetFileType GetFileAttributesExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadConsoleW HeapReAlloc HeapSize FindClose FindFirstFileExA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap SetStdHandle WriteConsoleW FindFirstFileW CreateEventW ReadFile

advapi32

CryptGenRandom CryptAcquireContextA CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges CryptAcquireContextW SetNamedSecurityInfoA CryptEncrypt AllocateAndInitializeSid SetEntriesInAclW OpenProcessToken FreeSid

shell32

ShellExecuteA

crypt32

CryptStringToBinaryA CryptDecodeObjectEx CryptBinaryToStringA CryptImportPublicKeyInfo

Sharing

General

Malware Config

Signatures

File Explorer

d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c-patched.exe

PE Signature issue

kernel32

advapi32

shell32

crypt32