yoomasu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
yoomasu.exe
Size 10.9MB
Sample261017-m14m2aee34
SHA256 03de2a61a423bb57ee26f6edbb2d43b888688e240fdac42b50708fe460254e91
MD5 b7d297593d472a9c7289855b476ff929
SHA1 3630bcef417cb8fc47137e2065f85feb08e42e53
SHA512 8cb3bb9bc2744a8f60153bb3ceeede4dbc9f2f9b0f8ae4ec8640830dff3108b7fadf6b727135469b934bfc5d7fa35d528b6aeac1086a3267f2ad89a6d8bfcca9
SSDEEP 196608:+MSbDm2zKB9Pn18x2luEYl7QHpJMxohZ4:Bhnix2uh6JFq
TLSH
T18EB6BF03F6A241E8C06EC1B5935AA637E772BC8D0A3472BF1BE41B212E5AF505F1D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

yoomasu.exe

.exe 10.9MB

yoomasu.exe

IMPHASH 732bd0503ee830ec8040494a05903c17
SHA256 03de2a61a423bb57ee26f6edbb2d43b888688e240fdac42b50708fe460254e91
MD5 b7d297593d472a9c7289855b476ff929
SHA1 3630bcef417cb8fc47137e2065f85feb08e42e53
SHA512 8cb3bb9bc2744a8f60153bb3ceeede4dbc9f2f9b0f8ae4ec8640830dff3108b7fadf6b727135469b934bfc5d7fa35d528b6aeac1086a3267f2ad89a6d8bfcca9
SSDEEP 196608:+MSbDm2zKB9Pn18x2luEYl7QHpJMxohZ4:Bhnix2uh6JFq
TLSH
T18EB6BF03F6A241E8C06EC1B5935AA637E772BC8D0A3472BF1BE41B212E5AF505F1D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

bc:03:54:9a:80:0e:fd:04:bd:ab:c4:b4:76:7e:dc:a4:bf:ae:35:8b:bd:3c:3d:c8:6a:40:b4:b1:28:51:ba:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=324508100159341,CN=ИП Емельянов Алексей Алексеевич,O=ИП Емельянов Алексей Алексеевич,L=Шаховская,ST=Московская область,C=RU,1.3.6.1.4.1.311.60.2.1.2=#130d4d6f73636f77204f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Oct 12, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

65:a6:26:83:13:63:08:3a:5a:9c:c6:9b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 1, 2026 - Jul 7, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

4985972

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

yoomasu.pdb

kernel32

GetModuleHandleA GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetModuleHandleW GetModuleFileNameW GetSystemTimeAsFileTime WaitForSingleObject LocalFree CreateProcessA ExitProcess DuplicateHandle GetSystemTimePreciseAsFileTime LoadLibraryW SleepConditionVariableSRW GetSystemInfo GetNativeSystemInfo SetHandleInformation IsProcessorFeaturePresent GetCurrentThreadId SetLastError HeapAlloc FormatMessageW CreateThread SleepEx CreateWaitableTimerExW SetWaitableTimer TerminateProcess GetExitCodeProcess GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FlushFileBuffers RtlUnwindEx GetLastError SwitchToThread RtlPcToFileHeader HeapReAlloc HeapFree GetProcessHeap SetThreadStackGuarantee RaiseException AddVectoredExceptionHandler RemoveDirectoryW CreateToolhelp32Snapshot lstrlenW EncodePointer ReleaseMutex EnterCriticalSection LeaveCriticalSection GetDiskFreeSpaceExW GetCurrentProcess SetFilePointerEx SystemTimeToFileTime SystemTimeToTzSpecificLocalTime FindNextFileW GetFileAttributesW ReadFileEx WriteFileEx MoveFileExW CopyFileExW GetFinalPathNameByHandleW GetTempPathW GetFileInformationByHandleEx DeleteCriticalSection GetFileInformationByHandle SetFileInformationByHandle FindClose FindFirstFileExW GetFullPathNameW CreateDirectoryW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle DeleteFileW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateFileW FlsAlloc FlsGetValue FlsSetValue FlsFree HeapSize IsValidCodePage GetACP GetOEMCP GetCPInfo CancelIoEx GetStringTypeW SetFileCompletionNotificationModes CreateIoCompletionPort LoadLibraryExA GetQueuedCompletionStatusEx ReadFile Process32FirstW Process32NextW PostQueuedCompletionStatus WriteFile GetProcAddress LoadLibraryA GetOverlappedResult FreeLibrary LoadLibraryExW OutputDebugStringW GetLocalTime SetUnhandledExceptionFilter OutputDebugStringA WaitForSingleObjectEx GetCurrentThreadStackLimits OpenProcess LCIDToLocaleName GetUserDefaultUILanguage CloseHandle CreateMutexA GetCurrentProcessId WaitForMultipleObjects CreateEventW ResetEvent GetProcessId VirtualAllocEx WriteProcessMemory CreateRemoteThread GetExitCodeThread VirtualFreeEx GetComputerNameExW CreateMutexW GetModuleHandleExW RtlVirtualUnwind Sleep CompareStringOrdinal CompareStringW MultiByteToWideChar LCMapStringW RtlLookupFunctionEntry SetStdHandle RtlCaptureContext GetFileType WideCharToMultiByte GetCurrentThread SetEnvironmentVariableW GetCommandLineA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW GetCommandLineW

shell32

Shell_NotifyIconGetRect SHAppBarMessage Shell_NotifyIconW SHCreateItemFromParsingName DragFinish DragQueryFileW CommandLineToArgvW ShellExecuteW SHGetKnownFolderPath

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoTaskMemAlloc

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

RtlNtStatusToDosError NtCreateNamedPipeFile NtOpenFile NtReadFile RtlGetVersion NtWriteFile NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx

gdi32

CombineRgn DeleteDC SetBkMode CreateRoundRectRgn CreateCompatibleDC SelectObject CreateDIBSection CreateRectRgn DeleteObject CreateSolidBrush BitBlt GetDeviceCaps SetTextColor

user32

AdjustWindowRect SetParent RegisterRawInputDevices GetWindow ReleaseCapture DestroyMenu EnumChildWindows MessageBoxW DestroyAcceleratorTable DispatchMessageA GetMessageA FindWindowW GetRawInputData SetTimer SendMessageTimeoutW GetMessageW RegisterClassW SetFocus ChangeWindowMessageFilterEx GetUpdateRect KillTimer MsgWaitForMultipleObjectsEx ValidateRect CreateAcceleratorTableW TranslateAcceleratorW TrackMouseEvent CreateMenu CloseTouchInputHandle CreatePopupMenu DrawMenuBar SetMenuItemInfoW CreateIcon RemoveMenu GetTouchInputInfo SetCapture GetParent FindWindowExW DestroyWindow GetKeyState PostThreadMessageW SetMenu PostMessageW DispatchMessageW TranslateMessage ScreenToClient GetAsyncKeyState UpdateWindow SystemParametersInfoA PostQuitMessage GetWindowThreadProcessId VkKeyScanW SetCursorPos SetCursor LoadCursorW GetForegroundWindow FlashWindowEx IsWindow SendInput CreateWindowExW EnumDisplayMonitors GetActiveWindow IsIconic IsWindowVisible RedrawWindow SetPropW MonitorFromPoint ShowWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity GetMenuItemInfoW GetMenuBarInfo MonitorFromRect SetWindowLongPtrW GetWindowLongPtrW ClipCursor GetClipCursor ShowCursor SystemParametersInfoW EnumWindows GetMonitorInfoW GetWindowPlacement GetClientRect SetWindowPlacement RegisterTouchWindow PeekMessageW ChangeDisplaySettingsExW SetWindowLongW GetSystemMenu DestroyIcon DefWindowProcW RegisterClassExW AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn SetWindowPos IsWindowEnabled EnableWindow SendMessageW GetKeyboardState RegisterWindowMessageA GetSystemMetrics MapVirtualKeyW ToUnicodeEx MapVirtualKeyExW SetWindowRgn GetKeyboardLayout IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC AppendMenuW InsertMenuW CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints InvalidateRect

comctl32

DefSubclassProc TaskDialogIndirect RemoveWindowSubclass SetWindowSubclass

ole32

CoUninitialize RegisterDragDrop OleInitialize CoInitializeEx CoCreateInstance RevokeDragDrop

oleaut32

SysFreeString SetErrorInfo SysStringLen GetErrorInfo

psapi

EnumProcessModulesEx GetModuleFileNameExW

advapi32

GetTokenInformation OpenProcessToken QueryServiceStatusEx RegDeleteTreeW OpenServiceW CloseServiceHandle RegCreateKeyExW ControlService RegEnumValueW RegEnumKeyExW RegDeleteValueW RegGetValueW RegSetValueExW RegQueryValueExW RegCloseKey OpenSCManagerW EventRegister RegOpenKeyExW EventSetInformation EventWriteTransfer EventUnregister

shlwapi

SHCreateMemStream

bcryptprimitives

ProcessPrng

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

ws2_32

send freeaddrinfo WSACleanup WSAStartup getaddrinfo setsockopt bind shutdown connect ioctlsocket WSASocketW WSASend closesocket recv WSAIoctl getsockopt getsockname WSAGetLastError getpeername

crypt32

CertFreeCertificateContext CertDuplicateStore CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertCloseStore CertEnumCertificatesInStore CertCreateCertificateContext CryptStringToBinaryA CertAddCertificateContextToStore CertOpenStore CertDuplicateCertificateChain

secur32

EncryptMessage AcquireCredentialsHandleA FreeCredentialsHandle DecryptMessage ApplyControlToken DeleteSecurityContext InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer QueryContextAttributesW

Sharing

General

Malware Config

Signatures

File Explorer

yoomasu.exe

kernel32

shell32

combase

api-ms-win-core-synch-l1-2-0

ntdll

gdi32

user32

comctl32

ole32

oleaut32

psapi

advapi32

shlwapi

bcryptprimitives

dwmapi

ws2_32

crypt32

secur32

generic