MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b72956e511dc7d916410a281111465d7d9a3220d89fe8611603e4e0004d9afb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.Yogi


Vendor detections: 10


Intelligence 10 IOCs YARA 7 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b72956e511dc7d916410a281111465d7d9a3220d89fe8611603e4e0004d9afb9
SHA3-384 hash: ef5d5e30dd422553b483749ef1bf49b291e178bc5650cb70776a911d27f3764c429c7c47fa70dffe7fee3d84532a7230
SHA1 hash: f9e3b95d21deb14adfa087e40890bd7776125c7d
MD5 hash: fe5a980247f47d903a316c750cfb10fc
humanhash: aspen-timing-quebec-tennessee
File name:cryptor_222.exe
Download: download sample
Signature Adware.Yogi
Create hunting rule
File size:5'625'295 bytes
First seen:2026-07-31 12:48:25 UTC
Last seen:2026-07-31 12:51:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cf72283be50852e418ce6bbb6b645835 (32 x Adware.Yogi, 10 x Efimer, 8 x BlankGrabber)
ssdeep 98304:pSgt2DICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolll+HcMSQ6JG:x2DICteErownP0oTcMsABql4oJ
TLSH T1FD463308B3E819E1FAB3D43D85665221D973B0254BB0D1CF43AC96661F676E0AF3EB50
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon c6c2ccc4f4e0e0f8 (49 x PythonStealer, 32 x Adware.Yogi, 29 x SVCStealer)
Reporter Anonymous
Tags:Adware.Yogi exe Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
225
Origin country :
UA UA
Vendor Threat Intelligence
Malware configuration found for:
PyInstaller
Details
Link:
https://research.acce.ciphertechsolutions.com/results/93012444-0207-4174-9688-7151ee738a1b/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76980/
Detection(s):
SecuriteInfo.com.Variant.Adware.Yogi.1551.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Restart of the analyzed sample
Creating a window
Creating a file in the %AppData% subdirectories
Running batch commands
Launching a process
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug expand installer-heuristic lolbin microsoft_visual_cc overlay packed packed packed pyinstaller pyinstaller reconnaissance
Link:
https://www.filescan.io/uploads/6a6c9b7d9d568a91a81b195d/reports/f897c7fe-dc8e-43ee-a2a9-e6ac7dcf046d/overview
Verdict:
Malicious
Labled as:
Adware.Yogi.Generic
Link:
https://www.hybrid-analysis.com/sample/b72956e511dc7d916410a281111465d7d9a3220d89fe8611603e4e0004d9afb9
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-31T11:22:00Z UTC
Last seen:
2026-08-01T22:24:00Z UTC
Hits:
~100
Detections:
Trojan.Win64.Agent.sb Trojan.Win32.Agent.sb Trojan-Dropper.Win32.Sysn.dfue Trojan-Dropper.FrauDrop.HTTP.C&C PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/b72956e511dc7d916410a281111465d7d9a3220d89fe8611603e4e0004d9afb9/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f155a0b7-6f9e-4fac-b54d-8c8b2363fe8e
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b72956e511dc7d916410a281111465d7d9a3220d89fe8611603e4e0004d9afb9
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/fe5a980247f47d903a316c750cfb10fc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b72956e511dc7d916410a281111465d7d9a3220d89fe8611603e4e0004d9afb9/
Threat name:
Win64.Adware.Yogi
Create hunting rule
Status:
Malicious
First seen:
2026-07-31 12:56:39 UTC
File Type:
PE+ (Exe)
Extracted files:
437
AV detection:
16 of 24 (66.67%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w4uvnzir3r6zczaqukarcfdf27m2giqnrh7imelahzhaabgzv64q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery persistence privilege_escalation pyinstaller
Link:
https://tria.ge/reports/260731-p6leragm61/
Behaviour
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Detects Pyinstaller
Hide Artifacts: Hidden Files and Directories
Adds Run key to start application
Creates a large amount of network flows
Looks up external IP address via web service
Creates a file in the Startup directory
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
b72956e511dc7d916410a281111465d7d9a3220d89fe8611603e4e0004d9afb9
MD5 hash:
fe5a980247f47d903a316c750cfb10fc
SHA1 hash:
f9e3b95d21deb14adfa087e40890bd7776125c7d
Link:
https://www.unpac.me/results/a0740000-ef42-41f2-859b-2067e440b1a5/
SH256 hash:
664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 hash:
63c4f445b6998e63a1414f5765c18217
SHA1 hash:
8c1ac1b4290b122e62f706f7434517077974f40e
Link:
https://www.unpac.me/results/a0740000-ef42-41f2-859b-2067e440b1a5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b72956e511dc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b72956e511dc7d916410a281111465d7d9a3220d89fe8611603e4e0004d9afb9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.Yogi

Executable exe b72956e511dc7d916410a281111465d7d9a3220d89fe8611603e4e0004d9afb9

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/76980/

Comments


Avatar
commented on 2026-07-31 13:12:52 UTC

https://www.virustotal.com/gui/file/b72956e511dc7d916410a281111465d7d9a3220d89fe8611603e4e0004d9afb9
HTTP requests
GET http://go-ns.org.ua/
GET http://go-ns.org.ua/wp-content/themes/go-ns/send-message-to-telegram.php
GET http://t.me/s/gononstopukraine
GET http://www.facebook.com/gononstopukraine
GET http://www.tiktok.com/@gononstopukraine
DNS Resolutions
go-ns.org.ua
ifconfig.me
t.me
www.facebook.com
www.tiktok.com
IP Traffic
TCP 149.154.167.99:80 (t.me)
TCP 149.154.167.99:443 (t.me)
TCP 23.220.162.217:80 (www.tiktok.com)
TCP 23.220.162.217:443 (www.tiktok.com)
TCP 57.144.218.1:80 (www.facebook.com)
TCP 57.144.218.1:443 (www.facebook.com)
TCP 104.21.85.170:80 (go-ns.org.ua)
TCP 104.21.85.170:443 (go-ns.org.ua)
TCP 34.160.111.145:443 (ifconfig.me)
TCP 23.218.232.27:443 (www.tiktok.com)
#malware #ransom