YAPA Malware Loader Research
Research notes focused on YAPA loader activity, including .NET malware analysis, obfuscation, configuration extraction, payload staging, infrastructure, and detection ideas. Notable file names: PDFChampions, PrimePDFConvert,PDFabulous, PDFriend, KitchenCanvas, MyConvertly, Duskreader, EmberPage, InkLeaf, Paperview, Amberscroll, Tideview, PDFBlender, TotalUserManuals, onlinespeedtest, JustAskJacky, GoAskBobby, EffortlessPDF.
Research Focus
-
Loader analysis
EvilAI, YAPA, and TamperedChef have used many techniques and eveolutions to operate. Some of these lead to RAT/Backdoors, while some lead to Browser Search Hijackers.
Observed Techniques Examples:
-
Configuration and Extractors
-
Detection opportunities
-
Related blog posts
YAPA-focused writeups and follow-on research can be found through the blog label page.