General
- Target yoinker.exe
- Size 21.0MB
- Sample240604-xbc4wsfg5t
- SHA256 57d3fb41ffa847f96b32f5592271e3a7e6e5b840d6b0e153286c58c10ac79038
Score
9/10
Malware Config
Targets
-
- Target yoinker.exe
- Size 21.0MB
- SHA256 57d3fb41ffa847f96b32f5592271e3a7e6e5b840d6b0e153286c58c10ac79038
Score9/10Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Drops file in Drivers directory
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1