General
- Target yoinker.exe
- Size 20.9MB
- Sample240604-qswt1ahb71
- SHA256 246eb64b071f5c06a44b7d138d2c45edb7f2b4bb93ec7007994ada52d26b7292
Score
9/10
Malware Config
Targets
-
- Target yoinker.exe
- Size 20.9MB
- SHA256 246eb64b071f5c06a44b7d138d2c45edb7f2b4bb93ec7007994ada52d26b7292
Score9/10Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Drops file in Drivers directory
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1