YandexPackSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
YandexPackSetup.exe
Size 10.1MB
Sample260619-pf3lcahs21
SHA256 d5b72aa5b7c38546bf8b8bcd2ed5349f15a20e23cff2542ee77df782be549b3f
MD5 38d9d64eb9eb245cb33643dbbf3d9373
SHA1 19804e2f156bbd3ce202e3b61a83221ee6b0371f
SHA512 5047bc348b7066d87f2502d19604d84073b663039bd71e1d38762577bf7d230d417271bf73d0434ace86a0a4d252c0791f05af449b44ab830060b132f65cf3b9
SSDEEP 196608:Ddad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:xadCoXrlAJ7N3pXW2uGzy
TLSH
T1B2B6D001B752C0B1EAD101B116BE9BBA487D9E144B3189C797C43E3DD9322E2673BF69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

YandexPackSetup.exe

.exe 10.1MB

YandexPackSetup.exe

IMPHASH 96ad112daaa8350b6e84b3e0e519e5bc
SHA256 d5b72aa5b7c38546bf8b8bcd2ed5349f15a20e23cff2542ee77df782be549b3f
MD5 38d9d64eb9eb245cb33643dbbf3d9373
SHA1 19804e2f156bbd3ce202e3b61a83221ee6b0371f
SHA512 5047bc348b7066d87f2502d19604d84073b663039bd71e1d38762577bf7d230d417271bf73d0434ace86a0a4d252c0791f05af449b44ab830060b132f65cf3b9
SSDEEP 196608:Ddad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:xadCoXrlAJ7N3pXW2uGzy
TLSH
T1B2B6D001B752C0B1EAD101B116BE9BBA487D9E144B3189C797C43E3DD9322E2673BF69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

b0:67:a1:03:eb:32:a9:ad:3d:99:ec:c2:aa:51:13:25:47:07:0a:7c:c8:c5:ab:bc:03:df:66:50:02:e9:69:80

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1027700229193,CN=YANDEX LLC,O=YANDEX LLC,STREET=Lev Tolstoy street\, 16,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 30, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

Serial Number

6f:12:6c:9c:c2:87:de:45:8c:e8:90:f6

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 20, 2024 - Mar 21, 2026

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

69161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\9efead2954b58eab\setupexe\Stardust\setupexe.pdb

msi

ord175 ord169 ord70 ord141 ord190 ord88

comctl32

ord17

psapi

GetModuleFileNameExW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateProcessesW

secur32

LsaEnumerateLogonSessions LsaGetLogonSessionData

kernel32

HeapFree GetCurrentProcess GetTempPathW WaitForSingleObject DuplicateHandle OpenProcess GetVersion GetLastError OutputDebugStringW LoadLibraryA CloseHandle HeapAlloc GetProcAddress LocalFree GetProcessHeap FreeLibrary CreateFileW UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery GetModuleFileNameW GetVersionExW CreateToolhelp32Snapshot MultiByteToWideChar Process32NextW Process32FirstW LoadLibraryW GetCurrentProcessId OpenMutexW CompareStringW GetCommandLineW GetUserDefaultUILanguage FormatMessageW DeleteFileW VerSetConditionMask VerifyVersionInfoW lstrlenW WideCharToMultiByte LCMapStringW LockResource LoadResource SizeofResource WriteFile LoadLibraryExW FindResourceExA SetFilePointerEx FindClose ExpandEnvironmentStringsW MoveFileExW HeapReAlloc HeapSize GetTempFileNameW CreateDirectoryW GetFileAttributesW GetModuleFileNameA ProcessIdToSessionId EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetACP GetModuleHandleExW ExitProcess GetStdHandle RaiseException RtlUnwind GetStartupInfoW FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW FindFirstFileExA SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW IsDebuggerPresent InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetCPInfo GetLocaleInfoW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW

user32

LoadStringW MessageBoxW MessageBoxExW EndDialog SetWindowTextW SetDlgItemTextW IsDlgButtonChecked SetDlgItemTextA DialogBoxParamW EnableWindow GetDlgItem

advapi32

LsaNtStatusToWinError LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey EqualSid CopySid ConvertStringSidToSidW OpenProcessToken RegOpenKeyExW ConvertSidToStringSidW GetLengthSid DuplicateTokenEx RegQueryValueExW LookupAccountNameW GetTokenInformation

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

StringFromGUID2

Sharing

General

Malware Config

Signatures

File Explorer

YandexPackSetup.exe

msi

comctl32

psapi

wtsapi32

secur32

kernel32

user32

advapi32

shell32

ole32

generic