Overview
overview
5Static
static
3YUB-X/Autoexec.lnk
windows10-2004-x64
3YUB-X/Autoexec.lnk
windows11-21h2-x64
3YUB-X/Bin.lnk
windows10-2004-x64
3YUB-X/Bin.lnk
windows11-21h2-x64
3YUB-X/Scripts.lnk
windows10-2004-x64
3YUB-X/Scripts.lnk
windows11-21h2-x64
3YUB-X/Workspace.lnk
windows10-2004-x64
3YUB-X/Workspace.lnk
windows11-21h2-x64
3YUB-X/YUB-X.exe
windows10-2004-x64
5YUB-X/YUB-X.exe
windows11-21h2-x64
5Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/05/2026, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
YUB-X/Autoexec.lnk
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
YUB-X/Autoexec.lnk
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
YUB-X/Bin.lnk
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
YUB-X/Bin.lnk
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
YUB-X/Scripts.lnk
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
YUB-X/Scripts.lnk
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
YUB-X/Workspace.lnk
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
YUB-X/Workspace.lnk
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
YUB-X/YUB-X.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
YUB-X/YUB-X.exe
Resource
win11-20260513-en
General
- Target YUB-X/Workspace.lnk
- Size 2KB
- Sample260517-pdvgysf131
- SHA256 c3b114113a0a521512ac112022f070b15485acafbc1d07d33762ab478707abe8
- MD5 578b4d5d76099469a6ee248603fe31c2
- SHA1 0d725c0b4d93db83f5ecbc9a6581decab3287323
- SHA512 7c15d37163d9acb7007d04800d7a10d4b8ecb3b78198111c9884df4415c209498818963fe75962c272c76cca568bb95ef90ea9ce72c014ab8c353758b3196dab
- TLSH T1CC4156015BD74A20D37FD8786AEF7295CB397611FB415A588058424918B2F80DD37B0F
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell cmd.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff cmd.exe