YanluowangMalware
- dryxiphia
According to PCrisk, Yanluowang is ransomware that encrypts (and renames) files, ends all running processes, stops services, and creates the "README.txt" file containing a ransom note. It appends the ".yanluowang" extension to filenames. Cybercriminals behind Yanluowang are targeting enterprise entities and organizations in the financial sector.From MISP Galaxy
Last reported 3 years ago, by Group-IB1 report
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1003OS Credential Dumping
“T1003”
- T1007System Service Discovery
“T1007”
- T1018Remote System Discovery
“T1018”
- T1021.001Remote Desktop Protocol
“T1021.001”
- T1021.004SSH
“T1021.004”
- T1027Obfuscated Files or Information
“T1027”
What the reports say
1 report, newest first · the exact sentence from each-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“The text of this note has largely been borrowed from the Yanluowang ransomware family.”
Indicators in its reports
named in the reports above- 4874d336c5c7c2f5…61ce9c38b86din 1 report
- 2fd264f58ba82a26…071f67bb67abin 1 report
- 03c41019faf7e4cc…4a20256c1813in 1 report
- 88081a21e500e831…b18a022f25bein 1 report
- aa48acaef62a7bfb…9a78864eb31fin 1 report
- b99d114b267ffd06…974bbce75bf2in 1 report
- 66bcad0829a59c42…bf65f13f3dc6in 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.