{
  "family": "yelloader",
  "sample_count": 30,
  "category": "trojan_downloader",
  "description": "Yelloader (tracked across security intelligence catalogs under signatures including TrojanDownloader:Win32/Yelloader, Trojan:Win32/Yelloader, and Trojan.Yelloader) is an evasive modular trojan downloader and stager active since 2016. Infiltrating endpoints primarily through malicious email attachments and weaponized installers, Yelloader uses anti-analysis techniques including hypervisor detection and delayed execution to bypass sandboxes. It establishes persistence via Windows Registry Run keys, beacons out to C2 servers over HTTPS, and downloads encrypted secondary binary payloads dropped into %Temp% or hollowed into trusted system processes.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Yelloader",
    "Trojan:Win32/Yelloader",
    "Trojan.Yelloader",
    "Win32/Yelloader",
    "TrojanDownloader:Win32/Yelloader.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/Yelloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yelloader is an evasive trojan downloader that stages secondary malware payloads like ransomware and infostealers onto Windows systems."
      }
    },
    {
      "@type": "Question",
      "name": "How does Yelloader bypass sandbox analysis?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for hypervisor artifacts, virtual machine drivers, and delays execution using sleep calls to exceed sandbox timeouts."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are dropped by Yelloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use Yelloader to deploy banking trojans, cryptocurrency stealers, keyloggers, and ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Yelloader maintain persistence on the system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes autostart entries in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and creates scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive steps prevent Yelloader compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce email gateway attachment filtering, restrict executable execution in %Temp%, and deploy modern behavioral EDR."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1497.001",
    "T1055",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Weaponized Office Attachments",
    "Exploit Kit Redirections",
    "Trojanized Freeware Downloaders"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted Secondary Payload Retrieval",
    "Anti-Sandbox & Hypervisor Detection",
    "Process Injection into svchost.exe",
    "Host Environmental Profiling",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTPS POST beacons transmitting host hardware identifiers and user privileges",
      "Outbound HTTP GET requests fetching XOR-encrypted secondary binary blobs disguised as font or image files"
    ],
    "evasion_techniques": [
      "Dynamic API resolution through PEB hash lookups to conceal API imports from static analysis",
      "Checking for hypervisor registry artifacts and terminating execution if detected"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "59f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8",
      "6af1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Yelloader",
      "HKCU\\Software\\Yelloader"
    ],
    "file_paths": [
      "%Temp%\\yelloader.exe",
      "%AppData%\\Yelloader\\stage.dat",
      "%LocalAppdata%\\Temp\\dl_cache.bin"
    ]
  },
  "defensive_measures": [
    "Implement Software Restriction Policies to block executable execution from %Temp% and %AppData%",
    "Deploy secure email gateways that quarantine macro-enabled office documents from untrusted external senders",
    "Configure EDR alerts for rapid downloader execution followed by code injection into system processes"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:Win32/Yelloader",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Yelloader"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Yelloader",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDownloader:Win32/Yelloader.A",
      "TrojanDownloader:Win32/Yelloader.B"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Malware Delivery",
  "sample_hashes": []
}