Unidentified 121 (Malware Family)

Unidentified 121

VTCollection

unidentified_121 acts as a downloader and reflective PE loader, employing a dual-mode execution strategy based on its privilege level. When executed without administrative rights, it uniquely attempts to bypass User Account Control (UAC) by first patching its own Process Environment Block (PEB) in memory to masquerade as explorer.exe, and then leveraging a specific COM object ({3E5FC7F9-9A51-4367-9063-A120244FBEC7} with the Elevation:Administrator!new: moniker) to relaunch itself with elevated privileges. This initial stage focuses purely on achieving elevation and does not perform C2 communication or direct payload execution itself in the non-elevated state.

Once running with administrative privileges (either initially or after successful elevation), the malware establishes persistence by creating a Scheduled Task named "BlaBlaAgu" using COM, configuring it to run with the highest privileges and repeat every five minutes indefinitely. It actively evades defenses by using PowerShell commands (Add-MpPreference) to add Windows Defender exclusions for its own process and the user's profile directory, reinforcing these exclusions every 60 seconds via a separate thread. Its primary function in this elevated state is to act as a downloader, connecting to its Command and Control (C2) server over TCP port 33334 using a custom protocol encrypted with an RC4-like cipher and the hardcoded key "ALB9SxZBzCqwPFnD"; after a distinct 20-byte client handshake (RC4 Key + integer 444, followed by a 16-byte server response (RC4 Key) for validation), it downloads further encrypted PE payloads and executes them reflectively in its own memory space.

References

2025-04-16 ⋅ VirusTotal ⋅ VirusTotal
b804ab085f7cf9ee546d586b36ebbeb73f874205b8fae048760dee78375ddf40
Unidentified 121

Yara Rules

[TLP:WHITE] win_unidentified_121_auto (20260917 | Detects win.unidentified_121.)

rule win_unidentified_121_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.unidentified_121."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_121"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b55fc 8b4518 89420c 8b4dfc 8b551c }
            // n = 5, score = 100
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   8b4518               | mov                 eax, dword ptr [ebp + 0x18]
            //   89420c               | mov                 dword ptr [edx + 0xc], eax
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   8b551c               | mov                 edx, dword ptr [ebp + 0x1c]

        $sequence_1 = { 807b0c5a 0f8578fdffff 4883c30d 31d2 }
            // n = 4, score = 100
            //   807b0c5a             | rep movsd           dword ptr es:[edi], dword ptr [esi]
            //   0f8578fdffff         | dec                 eax
            //   4883c30d             | lea                 edi, [esp + 0x48]
            //   31d2                 | mov                 ecx, 0x43

        $sequence_2 = { 8b55fc 8b4514 8a08 884a2d }
            // n = 4, score = 100
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   8b4514               | mov                 eax, dword ptr [ebp + 0x14]
            //   8a08                 | mov                 cl, byte ptr [eax]
            //   884a2d               | mov                 byte ptr [edx + 0x2d], cl

        $sequence_3 = { 8b55fc 8b4518 894208 837dd401 }
            // n = 4, score = 100
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   8b4518               | mov                 eax, dword ptr [ebp + 0x18]
            //   894208               | mov                 dword ptr [edx + 8], eax
            //   837dd401             | cmp                 dword ptr [ebp - 0x2c], 1

        $sequence_4 = { 31c0 b90a000000 488d35779e0000 f3a5 488d7c2448 b943000000 }
            // n = 6, score = 100
            //   31c0                 | test                edi, edi
            //   b90a000000           | jns                 0xfffffbc7
            //   488d35779e0000       | xor                 eax, eax
            //   f3a5                 | mov                 ecx, 0xa
            //   488d7c2448           | dec                 eax
            //   b943000000           | lea                 esi, [0x9e77]

        $sequence_5 = { 4e8d3c01 b920000000 f348ab c70700000000 0f8550010000 418b4114 }
            // n = 6, score = 100
            //   4e8d3c01             | cmp                 byte ptr [ebx + 0xc], 0x5a
            //   b920000000           | jne                 0xfffffd82
            //   f348ab               | dec                 eax
            //   c70700000000         | add                 ebx, 0xd
            //   0f8550010000         | xor                 edx, edx
            //   418b4114             | dec                 esi

        $sequence_6 = { 750c 48837c242801 0f8675fbffff 85ff 0f89c1fbffff e8???????? }
            // n = 6, score = 100
            //   750c                 | lea                 ecx, [eax + 2]
            //   48837c242801         | jne                 0xe
            //   0f8675fbffff         | dec                 eax
            //   85ff                 | cmp                 dword ptr [esp + 0x28], 1
            //   0f89c1fbffff         | jbe                 0xfffffb7b
            //   e8????????           |                     

        $sequence_7 = { 8b55fc 8b451c 89422c 8b4dfc }
            // n = 4, score = 100
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   8b451c               | mov                 eax, dword ptr [ebp + 0x1c]
            //   89422c               | mov                 dword ptr [edx + 0x2c], eax
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]

        $sequence_8 = { 8b55fc 8b4518 668b08 66894a32 }
            // n = 4, score = 100
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   8b4518               | mov                 eax, dword ptr [ebp + 0x18]
            //   668b08               | mov                 cx, word ptr [eax]
            //   66894a32             | mov                 word ptr [edx + 0x32], cx

        $sequence_9 = { 74ae 8b4338 3b433c 7da6 488b5330 }
            // n = 5, score = 100
            //   74ae                 | jne                 0x164
            //   8b4338               | inc                 ecx
            //   3b433c               | mov                 eax, dword ptr [ecx + 0x14]
            //   7da6                 | dec                 eax
            //   488b5330             | lea                 edx, [esp + 0xf0]

        $sequence_10 = { 488d9424f0000000 4889d9 ff15???????? 31c9 ff15???????? 4531c9 4531c0 }
            // n = 7, score = 100
            //   488d9424f0000000     | lea                 edi, [ecx + eax]
            //   4889d9               | mov                 ecx, 0x20
            //   ff15????????         |                     
            //   31c9                 | dec                 eax
            //   ff15????????         |                     
            //   4531c9               | stosd               dword ptr es:[edi], eax
            //   4531c0               | mov                 dword ptr [edi], 0

        $sequence_11 = { 8b55fc 8b4518 894268 6a08 }
            // n = 4, score = 100
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   8b4518               | mov                 eax, dword ptr [ebp + 0x18]
            //   894268               | mov                 dword ptr [edx + 0x68], eax
            //   6a08                 | push                8

        $sequence_12 = { 8b55fc 8b4520 894260 8b4dfc }
            // n = 4, score = 100
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   8b4520               | mov                 eax, dword ptr [ebp + 0x20]
            //   894260               | mov                 dword ptr [edx + 0x60], eax
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]

        $sequence_13 = { 8b55fc 8b4514 8b4d18 894204 }
            // n = 4, score = 100
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   8b4514               | mov                 eax, dword ptr [ebp + 0x14]
            //   8b4d18               | mov                 ecx, dword ptr [ebp + 0x18]
            //   894204               | mov                 dword ptr [edx + 4], eax

        $sequence_14 = { 4889d7 4183fe01 4889d6 4519ed 4183e5fd 4183c51e 4183fe01 }
            // n = 7, score = 100
            //   4889d7               | dec                 eax
            //   4183fe01             | mov                 ecx, ebx
            //   4889d6               | xor                 ecx, ecx
            //   4519ed               | inc                 ebp
            //   4183e5fd             | xor                 ecx, ecx
            //   4183c51e             | inc                 ebp
            //   4183fe01             | xor                 eax, eax

        $sequence_15 = { 80fa09 0f8757ffffff 0fb65002 488d4802 }
            // n = 4, score = 100
            //   80fa09               | cmp                 dl, 9
            //   0f8757ffffff         | ja                  0xffffff5d
            //   0fb65002             | movzx               edx, byte ptr [eax + 2]
            //   488d4802             | dec                 eax

    condition:
        7 of them and filesize < 2419712
}

Download all Yara Rules

Unidentified 121 Propose Change

References

Yara Rules

Unidentified 121