4893d6c4b2b0476c5cae46f681d40ef31cc39e915182dc10e3eb6e6725c9037e

Sharing

Copy URL Twitter E-mail

General

Target
YimMenu Legacy.zip
Size 5.8MB
Sample260804-qljk4axyas
SHA256 4893d6c4b2b0476c5cae46f681d40ef31cc39e915182dc10e3eb6e6725c9037e
MD5 529ce49caae0d1763f1e342b99af09e4
SHA1 babc810583d6a410a5c295a2af53058c9e577445
SHA512 e09bf9cd1461858d5dda7776d390bb6cd07ef29a642caa5a196f84d8d4291ca97b45fa91f450b62b2f56284680cb52b742d6b6b0644f803e4b9fdc80d29390ae
SSDEEP 98304:IdgcdLGOszGMLKByGHHvAaPkcBvI0k6gy/hhrrJ8G1VdrLCkbhk7ESyyBWvjIhdk:UgcdILKUYPAasc5dkOrJ5hL7+dyyBWK6
TLSH
T179563328F2EA1F10381B691BBB4DC7689ABB23D9FB1D9C99C440881578593B4327D1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  YimMenu Legacy.zip
- Size 5.8MB
- SHA256 4893d6c4b2b0476c5cae46f681d40ef31cc39e915182dc10e3eb6e6725c9037e
- MD5 529ce49caae0d1763f1e342b99af09e4
- SHA1 babc810583d6a410a5c295a2af53058c9e577445
- SHA512 e09bf9cd1461858d5dda7776d390bb6cd07ef29a642caa5a196f84d8d4291ca97b45fa91f450b62b2f56284680cb52b742d6b6b0644f803e4b9fdc80d29390ae
- SSDEEP 98304:IdgcdLGOszGMLKByGHHvAaPkcBvI0k6gy/hhrrJ8G1VdrLCkbhk7ESyyBWvjIhdk:UgcdILKUYPAasc5dkOrJ5hL7+dyyBWK6
- TLSH
  T179563328F2EA1F10381B691BBB4DC7689ABB23D9FB1D9C99C440881578593B4327D1B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  YimMenu Legacy/KAPTAN_KAPLAN injector.exe
- Size 1.5MB
- SHA256 f09c860ec6aed94872c98c5a1930b852a81b5d037619d0fae56e99162a4a6981
- MD5 07d3107978f1557d98ff2d8023307812
- SHA1 c38fda7c76f355743e4b0ab75300b91012e62aac
- SHA512 ca2a4101cecc9a298e17d73c8adc1a71086d49111ccb7ff643c83aae0049c70eb57f2d7e2a899cce04dd2de487ce8ebf3712613f41a25c714a30535d8bf83be3
- SSDEEP 24576:AGUFwIphyxytbWzJOrfMpuqcZJhrFQcCPbnGwvbq2CwBQbL0RJ7zAyVRnC6N/G:MFpphyYtbVMpOL5QrjnGwvmbLo9zAKn0
- TLSH
  T18375DF430A178E8BD13273FC5158FB9D416647E4B8278BA4EC792252EAD4F876D3E1E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral3 behavioral4
- Target
  YimMenu Legacy/Ultimate_Menu_V2.lua
- Size 211KB
- SHA256 d344013573cdb435f6d4deb7dd64ebdc02d53354efbe648b0af4e4961c6d8f68
- MD5 6e2cfb482195fbae34fab32b68a30805
- SHA1 cea3b911ae97798542bdc8b0ee300bb449eff80d
- SHA512 e5f13990dc35364bf746bce896610c134e891f5c9233bb315473dca1d31cf0a41be87e41d91dfb6825ea56017a3b6b5ebf506c4e74706f3b1fe1ca374277c514
- SSDEEP 3072:vRr0FoLQNs3ShThyY2/W/A1NK6kijLafFHzrzXUZcEBBamjH5diL:rW/A1NK6kimXycEDI
- TLSH
  T1CD2436681C8E192CFBD0FD5CAB620534DAE8523260CBA17C649ED1DCD12CA7761BECB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  YimMenu Legacy/Xenos.zip
- Size 569KB
- SHA256 b8f9defa241df2fe165855a407e66bc0bed49d446bc390a1d7b6dbad7c4c685f
- MD5 f73cac8b201f21df72e71652e2a94f1d
- SHA1 cdadbf9a9eae0ab1d32c0f3c3d4d242acf333dfc
- SHA512 1da27f13d6c8b2747ce02d731b70f51a5a03fa175452ffcc375905c191d5b14e5e675f389878cf39e9babbb55501efb10791e052d2d0454875f7ad75b336f897
- SSDEEP 12288:NJrRzhGLMKYazwCd+4FmdLN6/vTPsDvmxKLTvdDYVGnfrN:frDOMYXd+j6/vTPGvaKLyVGn5
- TLSH
  T118C42324D2F9550C2E7C5616EA88439CD28B7BE7576C5E33638764BBEC02F78249E423
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Xenos/Xenos64.exe
- Size 1.2MB
- SHA256 addf1e5903c21c0af873a45c7fc79f4d4eb2487c970a19ea96f51418431601a2
- MD5 bdeee5ec578fff586ed7b492ecd8849f
- SHA1 0445186897091a49458819d447fe92e457f088c6
- SHA512 dd898414b6ac27a58464c23511eb7e0cb7d411356b8f6ed26fddbbde9c628f92cc4e104f7fb1b6116631006893ffe37249e19b191d4c14cf801c2bc75fcaa497
- SSDEEP 24576:A+W3P+Wi1+WGHy8/8gdHn9mGIfBTcVmYWys18ES9DsKRzoome/sBiBJeBIi:A+W3P+Wi1+WGHDfH9mZddbP1fSZzZ1g
- TLSH
  T165457C5A7BA841F4D0B7913A8AA69156E7F2BC461B3187EF02A4531E7F33AE04D3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
behavioral10 behavioral9
- Target
  YimMenu Legacy/YimMenu.dll
- Size 10.9MB
- SHA256 45400ff910a637d563791fadc97bee672cf3306a452f2e5821b49e03fd78fa46
- MD5 41a5c330bd310d721b2d318b187306ce
- SHA1 05f1aaa25f0f5f19cdf47b2bcebac62c5e582079
- SHA512 ef3fb087216c315c4fe1b6905715abcd71943173d7b986033a1e71ad8e7d941b1949a10474f142e8b32d22cb4f4b34e6fab95fd41baed9904e945c990970146d
- SSDEEP 196608:ERAfriKHP41IEBT8wQGNxm9XsXDr+lp7dbVtFK:ERAfriKHP41IEBT8wQGNxm9XsXDrcK
- TLSH
  T1D3B65B2BE2A411ECD47ED1F4DE86A823E2F13448077499EB0AE04F565F777E0463AA53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12