Overview
overview
3Static
static
3YQArch_big...te.chm
windows10-2004-x64
1YQArch_big...te.chm
windows11-ltsc_2024-x64
1YQArch_big..._bk.js
windows10-2004-x64
3YQArch_big..._bk.js
windows11-ltsc_2024-x64
3YQArch_big...up.exe
windows10-2004-x64
3YQArch_big...up.exe
windows11-ltsc_2024-x64
3YQArch_big...st.exe
windows10-2004-x64
3YQArch_big...st.exe
windows11-ltsc_2024-x64
3YQArch_big...ch.dll
windows10-2004-x64
1YQArch_big...ch.dll
windows11-ltsc_2024-x64
1YQArch_big...lp.chm
windows10-2004-x64
1YQArch_big...lp.chm
windows11-ltsc_2024-x64
1YQArch_big...us.bat
windows10-2004-x64
3YQArch_big...us.bat
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/11/2026, 04:03
Static task
static1
Behavioral task
behavioral1
Sample
YQArch_big5/sys/donate.chm
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
YQArch_big5/sys/donate.chm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
YQArch_big5/sys/library/acaddoc_bk.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
YQArch_big5/sys/library/acaddoc_bk.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
YQArch_big5/sys/setup.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
YQArch_big5/sys/setup.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
YQArch_big5/sys/uninst.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
YQArch_big5/sys/uninst.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
YQArch_big5/sys/yqarch.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
YQArch_big5/sys/yqarch.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
YQArch_big5/sys/yqhelp.chm
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
YQArch_big5/sys/yqhelp.chm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
YQArch_big5/sys/yqkillcadvirus.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
YQArch_big5/sys/yqkillcadvirus.bat
Resource
win11ltsc2024-20260911-en
General
- Target YQArch_big5/sys/uninst.exe
- Size 60KB
- Sample261113-emb2vszw2k
- SHA256 1577389f197db9ea3bc23be2ce0a6d6e09690970fa7d8778efe868ce6c08e270
- MD5 5fa8e1edb7231b99ad370ad7aa60d1f1
- SHA1 6ec44a3bf92c85a7191e3f69c5d8152b57bfa657
- SHA512 2406623055c0a0dc2297fe64a06ad1cab7ef26fdcc98aefce45820d63ce925b96745ab85d232eb80479a17ca8eccf9cf81f13f07b97979cfee89ba78d0c70604
- SSDEEP 768:PA9sBTeThepYtY6M//vHMrs4OXDp+dH+RRustM:P45PM3pEdH+HjM
- TLSH T17E538326A6143523FE964A313BD420F76B306C716D00B91AF3866F8D18756C7B8A5B3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninst.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4016 uninst.exe