Is Yrnkubzk.exe safe?
Fifty-three of 75 engines flagged this unsigned executable, while runtime evidence showed Defender exclusions, credential-access indicators, injection behavior, and direct-IP payload retrieval.
The evidence strongly supports an MSIL information-stealer or loader, with several engines specifically naming PureLogs or PureLogger. A completed sandbox run observed endpoint-protection exclusions, LSASS-related activity, process-injection indicators, and retrieval of plugin3.bin from a direct IP address; keep security protection enabled and do not run the file.
0462245fee451140dd…09b89794c2c690Recommended next actions
Before running
Do not run it. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The evidence strongly supports an MSIL information-stealer or loader, with several engines specifically naming PureLogs or PureLogger. A completed sandbox run observed endpoint-protection exclusions, LSASS-related activity, process-injection indicators, and retrieval of plugin3.bin from a direct IP address; keep security protection enabled and do not run the file.
A broad 53 of 75 engines detected the sample, including 12 high-trust detections. ESET-NOD32, Fortinet, and Ikarus independently used PureLogs or PureLogger stealer names, although the overall family consensus is not strong enough to make the exact attribution certain. Runtime analysis produced a malicious sandbox result and recorded T1055 process injection, T1562.001 defense impairment, and PowerShell commands creating Microsoft Defender exclusions. The sample also contacted 154.12.226.43 for plugin3.bin and a heartbeat API, behavior consistent with a loader or information-stealing implant. Its unsigned, packed construction further supports the runtime and detection evidence rather than standing alone as the basis for the decision.
What We Detected
53 of 75 antivirus engines flagged this executable, including 12 high-trust detections. ESET-NOD32 and Fortinet named PureLogs, Ikarus named PureLogger, and Kaspersky identified a generic MSIL password stealer. The precise family name remains somewhat uncertain because other engines used MalwareX, Jalapeno, Kepavll, or generic trojan labels.
Threat Behavior
A completed sandbox run produced a malicious result and recorded seven offensive techniques. These include T1055 process injection and T1562.001 impairment of defenses. PowerShell commands added Microsoft Defender exclusions for RegAsm.exe and aspnet_compiler.exe, while separate evidence showed LSASS targeting, a common credential-access pattern. The executable also reached 154.12.226.43 to request plugin3.bin and a heartbeat API; the host was not present in the inspected reputation cache, but the observed paths and surrounding behavior remain highly concerning.
What To Do Now
Do not execute the file, and keep antivirus and endpoint protection enabled. If it already ran, isolate the computer from the network, remove the sample using trusted security tools, review Defender exclusions and firewall rules, and change credentials from a separate known-clean device.
Where this verdict could be wrong3 caveats
- engines.tier1FamilyConsensus.strong=false; engine naming varies among PureLogs, MalwareX, Jalapeno, and generic trojan labels.
- contactedHosts inspected 1 host and found no cached malicious or suspicious reputation, although the observed download and heartbeat paths remain concerning.
- droppedChildren inspected 3 files but all retained unknown verdicts, so no malicious child was independently confirmed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- contactedHosts found no cached malicious or suspicious reputation for the one inspected IP
- droppedChildren.hasMaliciousChild=false, though all three child verdicts remained unknown
- brandMismatch was not detected
- 53/75 antivirus detections
- 12 high-trust engine detections
- Completed sandbox produced a malicious verdict
- Microsoft Defender exclusions added through PowerShell
- LSASS-targeting and T1055 process-injection evidence
- Direct-IP retrieval of plugin3.bin and heartbeat traffic
Quarantine or delete the file without running it, and keep endpoint protection enabled. If execution occurred, isolate the system, inspect Defender exclusions and firewall rule 9090, run a full scan, and rotate potentially exposed credentials from a clean device.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete53 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Complete1 contacted host was cross-checked.
YARA
Complete6 signature or behavior rules matched.
External intel
PartialIndependent reference checks were attempted but are incomplete.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 30MITRE ATT&CK techniques
- 14spawned processes
- 3network contacts
- 8filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
High concern: Created or modified a system service, which can keep code running.
High concern: Changed an auto-start location that can make code run after sign-in or restart.
High concern: Attempted to impair or bypass security controls.
High concern: Manipulated how the operating system loads code, which can redirect execution.
High concern: Loaded code directly into memory instead of from a normal file.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How info-stealers work
An info-stealer runs quietly in the background and copies your private data — saved passwords, browser cookies, autofill details, and crypto wallets — then sends it to criminals. You usually won't notice anything is wrong.
Bottom line:Stolen logins are used to break into your accounts or sold in bulk on criminal markets.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
Yrnkubzk.exe
0462245fee451140ddb70d8570d444d1d703fd1e1fc003521f09b89794c2c690
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\tdeJK0J65x5p.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe'; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe'"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
StartupProfileData-NonInteractive
C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
04Isolated runtime analysis - Written fileObserved
powershell.exe.log
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
154.12.226.43
Contact observed during runtime.
06Isolated runtime analysis
6 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox; 1 returned "malicious".
Adversary techniques mapped to the MITRE ATT&CK framework.
- 154.12.226.43
- http://154.12.226.43/plugin3.bin
- https://154.12.226.43:2053/api/rig/heartbeat
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tdeJK0J65x5p_RASAPI32\EnableFileTracing
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tdeJK0J65x5p_RASAPI32\EnableAutoFileTracing
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tdeJK0J65x5p_RASAPI32\EnableConsoleTracing
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tdeJK0J65x5p_RASAPI32\FileTracingMask
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tdeJK0J65x5p_RASAPI32\ConsoleTracingMask
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tdeJK0J65x5p_RASAPI32\MaxFileSize
- C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- \Device\Http\Communication
- C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
- C:\Users\user\AppData\Roaming
- Global\3371e0d1b5d178021eba90
- 3371e0d1b5d178021eba90
- Global\OneSettingQueryMutex+compat+encapsulation
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache.
- 96ad1146eb96877eab59…87dcf7Never scannednever seen before
- 6529fc1329dc3915c17f…253456Never scannednever seen before
- 168561fb18f8eba8043f…740e3fNever scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 6rule hits recorded
- 53 / 75engines flagged
- 2sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 isolated runtime environment classified the observed behavior as malicious.
Verdict inputView chapterProvenanceObservedSourceIsolated runtime analysisObserved at - 02
3 high-confidence signature or behavior rules matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 03
53 of 75 antivirus engines flagged the file, including AhnLab-V3 and Alibaba.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 04
Scanned file: Yrnkubzk.exe — 0462245fee451140ddb70d8570d444d1d703fd1e1fc003521f09b89794c2c690
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\Desktop\tdeJK0J65x5p.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — "powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe'; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe'"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: StartupProfileData-NonInteractive — C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: powershell.exe.log — C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: 154.12.226.43 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: infostealer
Available reference checks returned no match, but at least one source was unavailable. This is not a clean result.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
Sample disabled Windows Defender real-time protection or added an AV exclusion path. This is the blow-the-doors-off move malware makes right before dropping a second-stage payload.
Evidence"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe'; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Reg…The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pPE is packed (high-entropy code or known packer) AND unsigned AND at least one engine flagged it. Packing alone is common in legit software; packing + unsigned + signal is the malware-dropper pattern.
Evidencepackers: Microsoft Visual C++ vx.x DLLSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exeThe sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence154.12.226.43Unsigned, packed PE with sandbox-observed network activity. The packing step hides the payload until execution; the network call fetches / reports for the next stage. Classic dropper / stager behaviour.
Evidencehttp://154.12.226.43/plugin3.bin
53 of 75 engines flagged this file
View all 75 engine results
Section entropy & packers
Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- Yrnkubzk.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 1.0 MB
- Last analyzed
- Oct 3, 2026, 7:52 AM UTC
0462245fee451140ddb70d8570d444d1d703fd1e1fc003521f09b89794c2c690Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't run this file. Delete this file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
From a different, clean device, change the passwords on your important accounts (email and banking first) and turn on two-factor authentication.
- Recovery step 04
Get a fresh copy from the developer's official site or an official app store.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is Yrnkubzk.exe a virus?
What is Yrnkubzk.exe?
How many antivirus engines detected Yrnkubzk.exe?
What should I do if I already ran Yrnkubzk.exe?
How do I remove Yrnkubzk.exe?
What kind of malware is Yrnkubzk.exe?
What is the SHA-256 hash of Yrnkubzk.exe?
How up to date is this analysis of Yrnkubzk.exe?
Community
Member reviews and reports for this exact file hash.