PUP.YLSoft
Table of Contents
Analysis Report
General information
| Family Name: | PUP.YLSoft |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
f0f9fb3c1304c3bfb47d62a46e5feeba
SHA1:
4c50ac704955323f2d9a3a304c6e2bcf2062eafb
SHA256:
CE72DBE94D3DBFA468182DEEE215A380457D62B736BD917CFF29585CD6076FCD
File Size:
3.25 MB, 3248761 bytes
|
|
MD5:
410a6ba523daf07b2c54be44446daa65
SHA1:
96b715516029b23af57ca4550f51f0c1e7b08fa5
SHA256:
9326315245F4CDB135D02F405F874ABB738C77C6904F23C30B770598E9404FC2
File Size:
78.99 KB, 78992 bytes
|
|
MD5:
47ccc210b3c9a22a6a8145695ea1030b
SHA1:
8c926ad91bc636269b71d427680d45bdb9de10a0
SHA256:
33689E601395753A41B068D1E35893BE8F0047055FDEC5876AC1E0D7854A2C8C
File Size:
109.32 KB, 109320 bytes
|
|
MD5:
831b90bf4e3297098165c5e3f09fa06f
SHA1:
060d00f81f1261a19e4c9c1e39418a3c4e7ae071
SHA256:
0B83C322E9AFE8B78AF0DBA78594EC1EEEE7AD65D85808D4655D82C8D4F8A213
File Size:
4.03 MB, 4026114 bytes
|
|
MD5:
92d8d8fcc69acc0bdc019c74608f55fc
SHA1:
59473d547ec0b01b0a23d3c2fa6b82b66f49ad0e
SHA256:
0589D2A62A2B8A1A8203680B49A99E3392E70B955FFA8C5915AA7C3890D2B6FB
File Size:
3.25 MB, 3247677 bytes
|
Show More
|
MD5:
5614fe34ed363896ba3f3718ff55f9ce
SHA1:
71d260dccbfd10f272948a5555eb56e10f3b756f
SHA256:
1E0B6899938D858ABAEB38254B9ED9AB91CD58E93108F42401A3FA6D2C197561
File Size:
6.43 MB, 6433552 bytes
|
|
MD5:
be91bc39c5f182ffc6eb6b54f40771dd
SHA1:
d5eb29aa94f5cf32214a444b6db1169ad391bc81
SHA256:
2764532A163AE70BD92371A01C82904F584BD58F7DB706DC8EEE52C4843AABBD
File Size:
387.70 KB, 387696 bytes
|
|
MD5:
21ad3bb7685b04b9f48f9ae79fe5f1a6
SHA1:
4bc1eabf102ea9cafc001a903f1180780e79e33a
SHA256:
5E51F540F58600E362D761557E5D7420A7134B8F7054DEFBECC47E8FF04889C0
File Size:
2.48 MB, 2483972 bytes
|
|
MD5:
0123f614a765752a4d77092c35823c63
SHA1:
16d92612abdc56b5ae002aae07427657e4f90bd4
SHA256:
07290AD60E5F341A3EF1823E6075F07E80B7BC4F6A3A5936204087AF28FC79BF
File Size:
6.43 MB, 6431392 bytes
|
|
MD5:
bedea549529669e9a1a5489d304d1dc0
SHA1:
f444e151537187d3116113510a6b86f3e8b1bd14
SHA256:
3F4B967043DCE7064BD77A574A61CB73A7E8B02BEE0606902BA1EF0E8A7AF04D
File Size:
219.93 KB, 219928 bytes
|
|
MD5:
013efd4bca749be9682203b6fdeab8de
SHA1:
fa415c672bf20c09330cf4bd63d106f24a8e82b6
SHA256:
461ABABE0BBA554468B071142487D057198E090AC96344AFCD17DD7C047420E5
File Size:
8.87 MB, 8866856 bytes
|
|
MD5:
67ca36c1986388a89b817ca218cab697
SHA1:
e0cd3c1b89d739de70fe505c5bcd7753440dcffb
SHA256:
A44CA394717A470F8D03F69B252D2088AAB54A68DE30D7AD643706E9D61E916D
File Size:
80.66 KB, 80664 bytes
|
|
MD5:
cc8c3b8de854b7229357f80cf1df45b9
SHA1:
31f42e8b857bb16e03448f3b2dd2a54367701c7d
SHA256:
359DA6A6BDFAE442FB24AC8A1CE549CBFC3A4960A0316459777A36077391CA0D
File Size:
9.16 MB, 9157688 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright | YL Software |
| Legal Trademarks |
|
| Original Filename |
|
| Private Build |
|
| Product Name |
|
| Product Version |
|
| Special Build |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Suining YiLong Software | Thawte Code Signing CA | Self Signed |
| SuiNing Yilong Software Store | thawte Primary Root CA | Root Not Trusted |
| SuiNing Yilong Software Store | thawte Primary Root CA | Hash Mismatch |
| Suining YiLong Software | thawte Primary Root CA | Root Not Trusted |
File Traits
- 2+ executable sections
- HighEntropy
- Inno
- InnoSetup Installer
- Installer Manifest
- Installer Version
- VirtualQueryEx
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.FDD
- Injector.AK
- Lumma.GFD
- Rugmi.IA
- Sheloader.A
Show More
- Stealer.KF
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\is-hfb3f.tmp\4bc1eabf102ea9cafc001a903f1180780e79e33a_0002483972.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-i03tc.tmp\31f42e8b857bb16e03448f3b2dd2a54367701c7d_0009157688.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-mv7t1.tmp\71d260dccbfd10f272948a5555eb56e10f3b756f_0006433552.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-nkkb7.tmp\16d92612abdc56b5ae002aae07427657e4f90bd4_0006431392.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-s7kg0.tmp\_isetup\_regdll.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-s7kg0.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-s7kg0.tmp\_isetup\_shfoldr.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-s7kg0.tmp\apnic.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-s7kg0.tmp\apnstub.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-s7kg0.tmp\license.rtf | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\is-s7kg0.tmp\toolbar.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\3c3948be6e525b8a8cee9fac91c9e392_1053bc6c384022f220ea45c1780667ac | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\60e31627fda0a46932b0e5948949f2a5 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\3c3948be6e525b8a8cee9fac91c9e392_1053bc6c384022f220ea45c1780667ac | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\60e31627fda0a46932b0e5948949f2a5 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\systemcertificates\authroot\certificates\742c3192e607e424eb4549542be1bbc53e6174e2::blob | RegNtPreCreateKey | |
| HKLM\software\microsoft\systemcertificates\root\certificates\be36a4562fb2ee05dbb3d32323adf445084ed656::blob | \ Ѐ 볝蚽㾜ࠛ컯퇄춈ᔻ ᰘ兘槹镹⍋ . Thawte Timestamping CA ਰࠆثԁ܅ࠃ 㚾嚤눯돛⏓괣䗴丈囖 晿煺硩騠ᑑ莝⃚ ꗨ뺘芄ﺎ炮ᔑ㔁뉶 ʥ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Encryption Used |
|
| Anti Debug |
|
| Network Wininet |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Wzigztkv\AppData\Local\Temp\is-MV7T1.tmp\71d260dccbfd10f272948a5555eb56e10f3b756f_0006433552.tmp" /SL5="$8036A,5968025,167424,c:\users\user\downloads\71d260dccbfd10f272948a5555eb56e10f3b756f_0006433552"
|
"C:\Users\Mkluaate\AppData\Local\Temp\is-HFB3F.tmp\4bc1eabf102ea9cafc001a903f1180780e79e33a_0002483972.tmp" /SL5="$70334,2181800,103424,c:\users\user\downloads\4bc1eabf102ea9cafc001a903f1180780e79e33a_0002483972"
|
"C:\Users\Fefogbbe\AppData\Local\Temp\is-I03TC.tmp\31f42e8b857bb16e03448f3b2dd2a54367701c7d_0009157688.tmp" /SL5="$B036C,8829136,163328,c:\users\user\downloads\31f42e8b857bb16e03448f3b2dd2a54367701c7d_0009157688"
|
"C:\Users\Fefogbbe\AppData\Local\Temp\is-S7KG0.tmp\ApnStub.exe" /tb=YLC /local
|
