e2e42e46117ef4a52271f2b3546581982d4e10277d432f428924f6441d6b95db

Analysis

user interaction
yes
max time kernel
35s
max time network
37s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/10/2026, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YBClicker.exe
Size 3.6MB
Sample261018-11wt3scg86
SHA256 e2e42e46117ef4a52271f2b3546581982d4e10277d432f428924f6441d6b95db
MD5 14d7d8d03731b827044f6e5b22b5694a
SHA1 48dd853bd1cfcba7de9bef29d84d665e575ad363
SHA512 52528cb93afb7a65492122ad439ae7c1a17fda5b60363db39d626b41d21c864cfc6d7a8fca2c4c4c0b7ba694003a0e9ea663179617c81b6f591e4192a7a339f9
SSDEEP 49152:YwuhLk93jWqeFocKr7SG1HNAhVw2dvI1mwyHjOg5m1rVwL6xeHqn5EtXbN2cdyuP:7zl0g5tqjwt19yHjOhVlxeHq69V
TLSH
T1F4062391F6D218FAE17BE474C9679845E67238850730E9E7037886A66F2B3D05B7EF00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	YBClicker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	YBClicker.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	YBClicker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	YBClicker.exe

C:\Users\Admin\AppData\Local\Temp\YBClicker.exe
"C:\Users\Admin\AppData\Local\Temp\YBClicker.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fishstrap.exe

Path C:\Users\Admin\Downloads\Fishstrap.exe
Size 2.1MB
SHA256 e3d27af8771729772f73fe5261ddfb8e6e6df168e096eede7b3401ee90a3f19c
MD5 42997590e95d77e4fcd02954d7357e81
SHA1 ce87ae74200e1f3f3cdba248b05a3ac6bf7b08bf
SHA512 78857edfce955634164934f3f0d07bdfa94ada69c499a0c94079c164bb9a9b7c24bee5f27c0308a30feb5642403454e0e8a5cd2ffeb34890f81cd9aee13aa952
SSDEEP 24576:hnYVO6dOE7zDMz2iMr1UDVO6dOE7YBhsDDdgU7iN9As1xaXsAnEI:hYVO6dOE78VO6dOE7YsmU7+AUxdAEI
TLSH
T119A58D57F7A9C668E16B9B345670571A87B23D169F3AE74F588CB92C0C333E04D207A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download