Overview

overview

10

Static

static

3

yodao_yyyfanyin.exe

windows7-x64

7

yodao_yyyfanyin.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    yodao_yyyfanyin.exe.vir

  • Size

    124.5MB

  • Sample

    240822-blejta1amh

  • MD5

    55e461d92984877c4e1f969d79898a28

  • SHA1

    01407a049914ca0b0d23e2d5256687eb2b12a8d3

  • SHA256

    30978f056576a9a857ae05dc9716e3b650cf7f710411be963a575daa9590d321

  • SHA512

    8b0988b2943cf7aedd0a73e4a59ff7e8483fc9052fe0258f4dfaf6a9e6c458407803035a27b8f0c3ed2a882ccc948176294de0f5e58fbb8ec935f16cc36b5474

  • SSDEEP

    3145728:f86lQ9Lc4L5F7clDxmrfckKaJ/HwpbQ1epNg6G6H0ZQh:kasc41F/0B/dk8h

Score
10/10
discovery

Malware Config

Targets

    • Target

      yodao_yyyfanyin.exe.vir

    • Size

      124.5MB

    • MD5

      55e461d92984877c4e1f969d79898a28

    • SHA1

      01407a049914ca0b0d23e2d5256687eb2b12a8d3

    • SHA256

      30978f056576a9a857ae05dc9716e3b650cf7f710411be963a575daa9590d321

    • SHA512

      8b0988b2943cf7aedd0a73e4a59ff7e8483fc9052fe0258f4dfaf6a9e6c458407803035a27b8f0c3ed2a882ccc948176294de0f5e58fbb8ec935f16cc36b5474

    • SSDEEP

      3145728:f86lQ9Lc4L5F7clDxmrfckKaJ/HwpbQ1epNg6G6H0ZQh:kasc41F/0B/dk8h

    Score
    10/10
    discovery

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks