General
- Target yatta_client.exe
- Size 87KB
- Sample261027-hcs46sa13v
- SHA256 a66da7f6a78659306bfdb45a53cefb7742563a0226c365039452e64621a53fea
- MD5 d1243ba69d5fcb49907f209a5a8171a3
- SHA1 c43503521fb9bb9b598b02395600d75b3dd73ee0
- SHA512 bb472dc862f315fc09c876beb7d38e988cbae51b1e6748c45e3ef997a7c3225b4201536491850f8f7ef8cc27095bd778160697a87f18fd80a6906339bf8eb8bb
- SSDEEP 1536:K/TRYO47g41/2EaioEdEZ0+z80Cje3ns+6P93lfyIlEFMzfwbhZJ+oAhmo/TtEZ:KVYOY1dZaioWEZHoj4sVfyIl40moLti
- TLSH T10093D04477F48638C4DD0EF699F3690443B4E7A68F62DBDE5DD8B0EB08727A11211BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
yatta_client.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
yatta_client.exe
Resource
win11ltsc2024-20260911-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target yatta_client.exe
- Size 87KB
- SHA256 a66da7f6a78659306bfdb45a53cefb7742563a0226c365039452e64621a53fea
- MD5 d1243ba69d5fcb49907f209a5a8171a3
- SHA1 c43503521fb9bb9b598b02395600d75b3dd73ee0
- SHA512 bb472dc862f315fc09c876beb7d38e988cbae51b1e6748c45e3ef997a7c3225b4201536491850f8f7ef8cc27095bd778160697a87f18fd80a6906339bf8eb8bb
- SSDEEP 1536:K/TRYO47g41/2EaioEdEZ0+z80Cje3ns+6P93lfyIlEFMzfwbhZJ+oAhmo/TtEZ:KVYOY1dZaioWEZHoj4sVfyIl40moLti
- TLSH T10093D04477F48638C4DD0EF699F3690443B4E7A68F62DBDE5DD8B0EB08727A11211BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Disables service(s)
-
Stops running service(s)
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
2Service Execution
2Windows Management Instrumentation
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Indicator Removal
1File Deletion
1