yatta_client[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
yatta_client.exe
Size 87KB
Sample261027-hcs46sa13v
SHA256 a66da7f6a78659306bfdb45a53cefb7742563a0226c365039452e64621a53fea
MD5 d1243ba69d5fcb49907f209a5a8171a3
SHA1 c43503521fb9bb9b598b02395600d75b3dd73ee0
SHA512 bb472dc862f315fc09c876beb7d38e988cbae51b1e6748c45e3ef997a7c3225b4201536491850f8f7ef8cc27095bd778160697a87f18fd80a6906339bf8eb8bb
SSDEEP 1536:K/TRYO47g41/2EaioEdEZ0+z80Cje3ns+6P93lfyIlEFMzfwbhZJ+oAhmo/TtEZ:KVYOY1dZaioWEZHoj4sVfyIl40moLti
TLSH
T10093D04477F48638C4DD0EF699F3690443B4E7A68F62DBDE5DD8B0EB08727A11211BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

costura packer

Malware Config

Signatures

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
yatta_client.exe
unpack001/aforge.dll
unpack001/aforge.video.directshow.dll
unpack001/aforge.video.dll
unpack001/costura.dll

File Explorer

yatta_client.exe

.exe 87KB
aforge.dll

.dll 17KB
aforge.video.directshow.dll

.dll 60KB
aforge.video.dll

.dll 20KB
costura.dll

.dll 5KB
costura.pdb

7KB

yatta_client.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a66da7f6a78659306bfdb45a53cefb7742563a0226c365039452e64621a53fea
MD5 d1243ba69d5fcb49907f209a5a8171a3
SHA1 c43503521fb9bb9b598b02395600d75b3dd73ee0
SHA512 bb472dc862f315fc09c876beb7d38e988cbae51b1e6748c45e3ef997a7c3225b4201536491850f8f7ef8cc27095bd778160697a87f18fd80a6906339bf8eb8bb
SSDEEP 1536:K/TRYO47g41/2EaioEdEZ0+z80Cje3ns+6P93lfyIlEFMzfwbhZJ+oAhmo/TtEZ:KVYOY1dZaioWEZHoj4sVfyIl40moLti
TLSH
T10093D04477F48638C4DD0EF699F3690443B4E7A68F62DBDE5DD8B0EB08727A11211BA2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Projects\yyttratt\yatta_rat\yatta_client\obj\Release\yatta_client.pdb

aforge.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Core\obj\Release\AForge.pdb

aforge.video.directshow.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb

aforge.video.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6771700a3bbd39251648d73bae181c3a4fa978ac40cccf4d5e2ac7815f18b406
MD5 27180a8ccb9c7d93bc5e1a95d67d3dbe
SHA1 31531eea4711cf48d5e834ff92738769389ee1cd
SHA512 f7ef2014320f82ff98c825b90a7229d74fe39b0e33fa7826b35f214dd5c51918c61e63acae8c19c42d817bd6ad571c9983766516c791b304db697df9dc5cf564
SSDEEP 48:6vP2nhx3BTjtRiaAVLEF4iZ6iMtTg706YElaWTJFu2FY+cYH6AWk1qyFVw2Ib8:JHtRYVLE4YjYELTru2FZFWv2
TLSH
T1A6B1FB28A7B8533BEF7BCB72585353804374BD10D92B5B1F1AC562172C323948931722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\303409\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

yatta_client.exe

mscoree

dotnet

aforge.dll

mscoree

dotnet

aforge.video.directshow.dll

mscoree

dotnet

aforge.video.dll

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb