Yanluowang
According to PCrisk, Yanluowang is ransomware that encrypts (and renames) files, ends all running processes, stops services, and creates the README.txt file containing a ransom note. It appends the .yanluowang extension to filenames. Cybercriminals behind Yanluowang are targeting enterprise entities and organizations in the financial sector.Files encrypted by Yanluowang can be decrypted with this tool (it is possible to decrypt all files if the original file is larger than 3GB. If the original file is smaller than 3GB, then only smaller files can be decrypted).
Threat level
LOW
Get an alert if one of your domains is named on a ransomware leak site.
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- GrabChrome
- GrabFF
- KeeThief
- Mimikatz
- NirSoft WebBrowserPassView
DiscoveryEnum
- AdFind
- Cent Browser
- S3 Browser
- SoftPerfect NetScan
LOLBAS
- NTDS Utility (ntdsutil)
- PsExec
- Windows Event Utility (wevtutil)
Networking
- Chisel
Offsec
- Cobalt Strike
- Impacket
RMM-Tools
- LogMeIn
- ScreenConnect
- TeamViewer
Known infrastructure
The following Tor hidden services have been associated with this group:
Yanluowang
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Yanluowang’s victim list.
risk score · threat categories · sources · age · confidence — in one request