yanluowang | 49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d

General

Target
49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d
Size 389KB
Sample240615-m989wasbmp
SHA256 49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d
MD5 ba95a2f1f1f39a24687ebe3a7a7f7295
SHA1 b4da6af343b27594fee7109a02ef699ba52f6e46
SHA512 4611ac65840c3ecee27f8821705f378de09ddbf1130476517f857abf3b1cf0f169ca618c82cc905d56f224019dbb01795ca458453a64cc51e100f7bbfc2781ee
SSDEEP 6144:SKmb+LOzyGKPCVqlea2MqxOnsAOK1RUa+jE6S3qVFvxTn:SfaLQyGK6kAa2XgsA1RUa+jE6S3qRT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

yanluowang

Malware Config

Signatures

Detects Yanluowang ransomware 1 IoCs

resource	yara_rule
sample	family_yanluowang

Yanluowang family
yanluowang

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d

File Explorer

49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d

.exe 389KB

49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d

IMPHASH 380467bc2cc16b8ce64d4802632fe491
SHA256 49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d
MD5 ba95a2f1f1f39a24687ebe3a7a7f7295
SHA1 b4da6af343b27594fee7109a02ef699ba52f6e46
SHA512 4611ac65840c3ecee27f8821705f378de09ddbf1130476517f857abf3b1cf0f169ca618c82cc905d56f224019dbb01795ca458453a64cc51e100f7bbfc2781ee
SSDEEP 6144:SKmb+LOzyGKPCVqlea2MqxOnsAOK1RUa+jE6S3qVFvxTn:SfaLQyGK6kAa2XgsA1RUa+jE6S3qRT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Yanluowang ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

145671

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\111\Desktop\wifi\project\ConsoleApplication2\Release\ConsoleApplication2.pdb

kernel32

Process32FirstW CloseHandle GetLogicalDriveStringsA SetFilePointerEx LocalFree SystemTimeToFileTime GetSystemTime MoveFileW GetDriveTypeW CreateFileA LocalAlloc SetFilePointer FindNextFileA SetFileTime TerminateProcess WriteFile GetCurrentProcess FindFirstFileA Process32NextW GetLastError CreateToolhelp32Snapshot OpenProcess CreateFileW GetCurrentDirectoryA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx GetFileSizeEx GetModuleHandleW GetProcAddress InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime RtlUnwind RaiseException InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetStdHandle GetCommandLineA GetCommandLineW GetACP HeapAlloc HeapFree GetFileType GetFileAttributesExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadConsoleW HeapReAlloc HeapSize FindClose FindFirstFileExA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap SetStdHandle WriteConsoleW FindFirstFileW CreateEventW ReadFile

advapi32

CryptGenRandom CryptAcquireContextA CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges CryptAcquireContextW SetNamedSecurityInfoA CryptEncrypt AllocateAndInitializeSid SetEntriesInAclW OpenProcessToken FreeSid

shell32

ShellExecuteA

crypt32

CryptStringToBinaryA CryptDecodeObjectEx CryptBinaryToStringA CryptImportPublicKeyInfo

Sharing