yanluowang | 0ee3cfe5e7033830cff6bdaa03e13bdd02ffdabd3858e9b1bf8eb8cdd4b0fc35

Sharing

Copy URL Twitter E-mail

General

Target
0ee3cfe5e7033830cff6bdaa03e13bdd02ffdabd3858e9b1bf8eb8cdd4b0fc35
Size 1.8MB
Sample231213-rdpyksdgbl
SHA256 0ee3cfe5e7033830cff6bdaa03e13bdd02ffdabd3858e9b1bf8eb8cdd4b0fc35
MD5 fa7fb7b2c63f7540a24ffeea6b69865e
SHA1 774bf75bcce48c71c9ef03d4e16269c1743aa665
SHA512 b9cb112e5452d1662bd08db8cab96f1905774cea15c608a9e5e6f60a043259605d7345ff4a6cf3385ed0c543c56cdedf47204a5e2cd9c31f81c04b94528e55cd
SSDEEP 24576:tiQgbCg3bFUW8rYN5khIah05/3wIynXp/O:PmCgFDihqIIyn5/O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

yanluowang

Malware Config

Signatures

Detects Yanluowang ransomware 1 IoCs

resource	yara_rule
sample	family_yanluowang

Yanluowang family
yanluowang

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ee3cfe5e7033830cff6bdaa03e13bdd02ffdabd3858e9b1bf8eb8cdd4b0fc35

File Explorer

0ee3cfe5e7033830cff6bdaa03e13bdd02ffdabd3858e9b1bf8eb8cdd4b0fc35

.exe 1.8MB

0ee3cfe5e7033830cff6bdaa03e13bdd02ffdabd3858e9b1bf8eb8cdd4b0fc35

IMPHASH 4f2f006e2ecf7172ad368f8289dc96c1
SHA256 0ee3cfe5e7033830cff6bdaa03e13bdd02ffdabd3858e9b1bf8eb8cdd4b0fc35
MD5 fa7fb7b2c63f7540a24ffeea6b69865e
SHA1 774bf75bcce48c71c9ef03d4e16269c1743aa665
SHA512 b9cb112e5452d1662bd08db8cab96f1905774cea15c608a9e5e6f60a043259605d7345ff4a6cf3385ed0c543c56cdedf47204a5e2cd9c31f81c04b94528e55cd
SSDEEP 24576:tiQgbCg3bFUW8rYN5khIah05/3wIynXp/O:PmCgFDihqIIyn5/O
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Yanluowang ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

404000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

624KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

745KB

Virtual Size

744KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

449KB

Virtual Size

798KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

0ee3cfe5e7033830cff6bdaa03e13bdd02ffdabd3858e9b1bf8eb8cdd4b0fc35

kernel32

generic