Yashma ransomware builder v1.2.exe

Classification: Malicious

Yashma ransomware builder v1.2.exe is a ransomware (application/x-dosexec, 538.0 KB). Detected by 69 antivirus engines. Linked to Chaos malware.

Detection summary

  • 69 antivirus detections
  • 0 IDS alerts
  • 1 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: CHAOS (S0220)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Chaos Triage 2026-02-24 14:36:26 2026-09-19 13:46:42 malicious-activity S0220 Chaos
Generic Malware Hybrid-Analysis 2024-02-29 23:30:04 2024-02-29 23:30:04
Yashma MalwareBazaar Abuse.ch 2022-05-12 07:14:12 2022-05-12 07:14:12 malicious-activity
Generic.Malware MalwareBazaar Abuse.ch 2022-05-12 07:14:12 2022-05-12 07:14:12 malicious-activity

Tags

windows-server-utility chaos adware defense_evasion discovery evasion execution impact persistence ransomware spyware stealer privilege_escalation

Sample information

Filenames
Yashma ransomware builder v1.2.exe, f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db.exe
File type
application/x-dosexec
Size
550912 bytes
MD5
13e878ed7e547523cffc5728f6ba4190
SHA-1
878ad3025f8ea6b61ad4521782035963b3675a52
SHA-256
f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db
SHA-512
a7fa4f14deb65aa8de18e37e4fba3d2fa6ed696b70c4d0f1f49a65a4d43da76eff0d9a9c4703a6e3c13a37eb5d1a427e43be8c0ea6b1288a50a1c5175d9392c7
First indexed
2022-05-12 08:15:02
Last updated
2026-09-19 13:55:44

Antivirus detections

EngineDetection
ALYacMisc.Riskware.RansomBuilder
AVGWin32:RansomX-gen [Ransom]
AhnLab-V3Ransomware/Win.RyukCrypt.C4580171
AlibabaRansom:MSIL/RyukCrypt.d856017d
Antiy-AVLRiskWare/MSIL.Crypter
ArcabitTrojan.Ransom.Imps.3
AvastWin32:RansomX-gen [Ransom]
AviraTR/Dropper.MSIL.nsomp
BitDefenderGen:Heur.Ransom.Imps.3
BkavW32.Common.91300906
CAT-QuickHealTrojan.YakbeexMSIL.ZZ4
CrowdStrikewin/malicious_confidence_100% (W)
Cybereasonmalicious.25f8ea
Cylanceunsafe
DeepInstinctMALICIOUS
DrWebVirusConstructor.Encoder.11
ESET-NOD32a variant of MSIL/Riskware.Crypter.VH
Elasticmalicious (high confidence)
EmsisoftGen:Heur.Ransom.Imps.3 (B)
F-SecureTrojan.TR/Dropper.MSIL.nsomp
FireEyeGen:Heur.Ransom.Imps.3
FortinetRiskware/Crypter
GDataGen:Heur.Ransom.Imps.3
GridinsoftRansom.Win32.AI.sa
IkarusTrojan.IL.MSILZilla
JiangminVirTool.MSIL.y
K7AntiVirusRiskware ( 0058b2cc1 )
K7GWRiskware ( 0058b2cc1 )
KasperskyHEUR:VirTool.MSIL.Agent.gen
KingsoftMSIL.VirTool.Agent.gen
LionicHacktool.Win32.Crypter.3!c
MAXmalware (ai score=100)
MalwarebytesCryptTool.RiskWare.Obfusticator.DDS
MaxSecureTrojan.Malware.182872413.susgen
McAfeeRDN/Chaos
MicroWorld-eScanGen:Heur.Ransom.Imps.3
MicrosoftRansom:MSIL/RyukCrypt.PD!MTB
NANO-AntivirusRiskware.Win32.Encoder.jpbnbn
PandaTrj/GdSda.A
RisingHackTool.Crypter!8.414 (CLOUD)
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Suspicious PE
SkyhighRDN/Chaos
SophosMal/MSIL-AW
SymantecTrojan Horse
TencentMalware.Win32.Gencirc.10bdd494
TrendMicroRansom.MSIL.CHAOS.THEAGBB
TrendMicro-HouseCallRansom.MSIL.CHAOS.THEAGBB
VBA32TrojanRansom.MSIL.gen
VIPREGen:Heur.Ransom.Imps.3
VaristW32/ABRisk.DSRV-2800
WebrootW32.Malware.Gen
XcitiumApplicUnwnt@#1u7t6lqwg42m6
YandexRiskware.VirTool!YPf2hOR+y8I
ZillyaTool.Crypter.Win32.3455
ZoneAlarmHEUR:VirTool.MSIL.Agent.gen
MicroWorld-eScanGen:Heur.Ransom.REntS.Gen.1
Cybereasonmalicious.d7e547
APEXMalicious
BitDefenderGen:Heur.Ransom.REntS.Gen.1
Ad-AwareGen:Heur.Ransom.REntS.Gen.1
EmsisoftGen:Heur.Ransom.REntS.Gen.1 (B)
FireEyeGen:Heur.Ransom.REntS.Gen.1
GDataGen:Heur.Ransom.REntS.Gen.1
ALYacGen:Heur.Ransom.REntS.Gen.1
MAXmalware (ai score=85)
MalwarebytesMalware.AI.1605093323
TencentWin32.Trojan.Ransom.Dzki
MaxSecureTrojan.Malware.300983.susgen

Process list

NameCommand line
Yashmaransomwarebuilderv1.2.exe