xh�R���������. �=�RPq9H�xh�+�b� �rR�l%�W��}TƗɵ��(�����3+Z��ń�!�o�mzt���`�6������z��]��Cc���8Y�?\O�@ϫ�?f������ɤXU�.�@�E�<�kn�V�/k'"直}6D!��1�s��V<gM5�r�9�c2Pr~��fs�dS�5Ȧ��"�&�pC�վ��19��-�(9�.��$�-�%z�V:L���B[ӧ @��}�=���ho'9)#kx�T�<M�-�,���k��Vݚ���K�Ǭ���+H���`����J��O+t�J&��8]�*,e~^me����C1�݊|[�x�}�ixTD��ͳ�&Dm<�S0?Q�Mw�҈�$<�����d$�KbWj�@oz;:-@�1@���`���h`,�6Cw�@G��F��O+"^љAtƯ��bDP�U��y3ᑰ���5F3su �96D4R$�G].{����u���G#+�a��_8t��blL)� ?��6�%�)S��c����Y��^1���5[k�!�u ��)�����&�e�b�HwB�M��eeW�N%G�;��R�0.uu�b�;l�9��#h}& ��\_�Ԩ���TeH��@Ҍ=J钭�|��Œ���N�c����z�衹%+�Y��Pw���V@,O���D������!Ij/��[�z�U����:�d��c�E��a?[�#;)ߎ�ߐ�zOd!%�{'�.%{akt� "�"�ʦ#7���n~1�*���b _�x��7i�R]�&�����K(�*j(�ҍ��g5��N Z�q��BmځF�Yna��/�9��I��;� ͦ�J���l��]�}K�>F��C�9��E��Z�a8�H;�)<�m�ۏO���yx��������6W�SX��r+.F�[Q�ȎH�}�Ej^XR~�Kz�����X3$0��.a��9��.�����w�>��'Ѕ�����1)y��dlt͜��r(����6� �.�[`������[��������*�h��r�oy�N��d�'C��+���ve3M=� �f(Y`�V+���InƂ�7ߣ�T Q��cΌڰ�Ia|��<[}��O�y�wn�]Ĭ���]��ѝk��� [�!c��G U�ԣ�*��n�2T�q}���]������TXHD��ţ xR����_�1�D�� й��s� ��x�r�����Zo�VF��Vm���J���Y�%Q�d����_Ǫ�����Vłx���5ou����r��T��:X�²Q�|e�[0� ��~/�����m3�5_a�0��t9��y����uQ�=��<N�q8I �@�|��T���������I��*^j�$X��Qe⹙��-��;����Ř��\�����Z�n��D�]v+�5�� (H��!��J+�����N���Y����[�!��(&�27�K�NJٯ��|�Dž���9�Q���$�*)�oC�� \ŏ�β��).5Z E�ؓ#ImGv����_tU߀�4�>u#��Dc�J+iv �KC��ڿ7r�x-���Q�q$:�C�W|�Z!tk��#V� �0�A�1K�\����Dg3�� �l���� ��QV���f�����Q����T8���:�v�8{d� ��#d���'�@�<�S���H��������/1T*~���� = B��@�~���q�HkE^�I�ݥ-��������J�|�jا'@��Q�H����4��6���6�Lla�JQ�B��S2�sW05`��&c�)E�c1�?툪z0s&�܄�Nj�QF�� `GwSl�{ �?���V���R7Z����eAd����-����'��+gZ����\R���{��y�(�W�"�)n�Չ̤�sj#P�At��99>����'i�bF�{J���(Z�7؝:�o_�r����1�{w��� <�Yy:BRd��xk[��5����:W�5��� PD�&J~|2XK��8]�HK��dUЌ"�ܱ;�1gpGA�cg��q��At��6��'�N�K.�n��K��AH�yK�������o���<�q ��6 ���� ����;��J�;]�}pE�7'����VpY���Nq�:�;�A�A^̈k�L�l�Hi����GS��F��O���o���cSM�v��7j<]n��3��V��U�@���6�&� �q���mDM�XA�si� ���E9M�,�BQ��B~A����fR��Q�Cӎ��ܻ�H�Vg��"B�|p����?v6}�i�^a�ߠR�N&A��wjE~tJ؆mM��}Y�+Pf�rX��J����&�Ɩ5@|6��I�/9�l�����wA@*{�0�?u<��I֧� Tk��R1�o .����R�N6��Q�{�����n@�ܕ�S�^����V�� .�l^��o:.KZ�(�w��g�g��(��H��W����|�e����U����֢ ���Q½�>�J�Q�q���}�s"���L��9�_t��2#,�`�U6��_l�1�Ѕ�&�{a�)[�3�5���y�Cg����hq�md�Zv����WRPr��;���Ak��s�cv����n /�a�� ���-�o�8x�tƇ}��۶��9 ��⍥p�S2�����K���Hh)Bo�q\�A��&������_�j�N���Ӈ|�����JՋ�_�e��g�~N"�vwP�����I��36�����ֱ��,L��7��6. ���*� ���i�ҬP���P��_E���Z�2m�D��tB�`G>i�L�k����g��@q�<탩�E7y/����«�� a�v�^{8�c�t�!�T�JT�D`T�CL��P�7PV�G?���y����F��e)��2���! �V��~�E\�G��Jq�U1�=fx�[��q|��#[_d�͵u�0G�V�����n6���������,֏��M�7��:7�*C�{�#�0��hVV� v��1o eNM�R ?���\Zt�K�^�>��(L�=$n/���}AFS�A�����R�Z�/w�;�K{K�@�춮�*ӏ4쑤X��S��+ �#�4��
General
-
Target
yuki-loader.exe
-
Size
9.3MB
-
MD5
678e7a79f9dd04c0451dc1a36fe4f044
-
SHA1
eb16042b424d52bcb1b26038e029d1b8364047e6
-
SHA256
2d1ecc458d2ca9438e3d231c943666ffb0a064a7efdc633e6437363dd99bfb9e
-
SHA512
8744792db8d38efcb5d947cab6f35d62006394df85d73069875cfcdf7fa4f0655095c70b3dd2e3c9e90543e3d06d905397f5d2cb928e0b18c60cc2f314b5e422
-
SSDEEP
196608:9rDK5xdvlKEz467yMTJQJMTh0d5z2L0fla6flkZrKPBqYxeX5f:6HG6WMi/52LOlzflaKPJk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource yuki-loader.exe
Files
-
yuki-loader.exe.exe windows:6 windows x64 arch:x64
Password: 1
9d7671f5c63c0273a8fb0dfdd3bf724f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateDirectoryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
InitializeAcl
shell32
SHGetFolderPathW
msvcp140
?_Xbad_function_call@std@@YAXXZ
winhttp
WinHttpOpen
imm32
ImmGetContext
d3d9
Direct3DCreate9
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertAddCertificateContextToStore
ws2_32
getsockname
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_time64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 824KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ