MALICIOUS — 0204bc0eb6110a101bc11e7908023e62f8ff4ad945b1e3f3f479a29b73222cac

MALICIOUS — 0204bc0eb6110a101bc11e7908023e62f8ff4ad945b1e3f3f479a29b73222cac is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the QakBot family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 0204bc0eb6110a101bc11e7908023e62f8ff4ad945b1e3f3f479a29b73222cac
SHA-1: f45aba5e08d543b8b6125349f04021973d73c565
MD5: 3a4db88c1395729f61641e2e1d98928f
imphash: 2d090d1553657abf85779591e21d6c5f
ssdeep: 24576:za0h5ur4JZfXoruO22nQtabiYY8qa/SBm/cQrvvn2QhuR3817zZa6:zrJuAVQrn2QhuR3i7d
TLSH: T104578D7D132BBA13D739CA2409426F9E0073E896A1723C8E51B7943DB7F4C6B5A4122D
Submitted as: 0204bc0eb6110a101bc11e7908023e62f8ff4ad945b1e3f3f479a29b73222cac
File type: pe · Size: 1489920 bytes
Verdict: malicious (99/100) · Family: QakBot

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Zusy-9907845-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Bunitucrypt.DE!MTB
Emsisoft (Emergency Kit): Gen:Variant.Qbot.642
Kaspersky (KVRT): UDS:Trojan.Win32.Injuke.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.Zusy-9907845-0 (rule Win.Trojan.Zusy-9907845-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Bunitucrypt.DE!MTB (rule Trojan:Win32/Bunitucrypt.DE!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Qbot.642 (rule Gen:Variant.Qbot.642) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.Win32.Injuke.gen (rule UDS:Trojan.Win32.Injuke.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

3812 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\tsk_bf24e1358ebf455f.dll - a21e5af92e8b2bc9b380b5fa7154979cdccaa9f876f4097fc08def0690be8a55
18df034ee69d675ce1b04b95569154f0e3fe41c8bd6a00e59e8dae24b41ed7f7 - 18df034ee69d675ce1b04b95569154f0e3fe41c8bd6a00e59e8dae24b41ed7f7
b15de0ea09ae9eaaab3ef231a7e00c9cdee82888eeb2dbf5fe9356510b271251 - b15de0ea09ae9eaaab3ef231a7e00c9cdee82888eeb2dbf5fe9356510b271251
c8ffa77637e05479dc55b7e99df49a41186895ea10b45aa20730bebef458d8c2 - c8ffa77637e05479dc55b7e99df49a41186895ea10b45aa20730bebef458d8c2
814afa2b21f1e2159cdd9ad5e4906f6631f4bc44737150cbbda9de9d214ea86c - 814afa2b21f1e2159cdd9ad5e4906f6631f4bc44737150cbbda9de9d214ea86c
9d3c5ff789acfd209c7f6dad90761797f3da4e52777c157aeb0de5544c1d3e1c - 9d3c5ff789acfd209c7f6dad90761797f3da4e52777c157aeb0de5544c1d3e1c
87707c2343c1e710109622ee1e8abfceac0ab7e2574a66c9b1125ad8ee5a7b4b - 87707c2343c1e710109622ee1e8abfceac0ab7e2574a66c9b1125ad8ee5a7b4b
87715bc61b1007b1bff6105b0a26d578430e473d2d5372778e198c2b2a2c83e6 - 87715bc61b1007b1bff6105b0a26d578430e473d2d5372778e198c2b2a2c83e6
0d0c3730a5d469053b5a8cb473ab6508e71202d6b0b757a89a5580d5b8647a39 - 0d0c3730a5d469053b5a8cb473ab6508e71202d6b0b757a89a5580d5b8647a39
20223d8d255d7c3503f6c25fcc4c2463e9961f0eb4b9d1a4893df294b519e94b - 20223d8d255d7c3503f6c25fcc4c2463e9961f0eb4b9d1a4893df294b519e94b
5681894942e795015baf1b80ebdf4d420d7627dabea33e26df32b312ccb72398 - 5681894942e795015baf1b80ebdf4d420d7627dabea33e26df32b312ccb72398

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.207.44.66
52.123.252.242
52.230.59.222
4.230.171.124
172.64.154.167
172.178.240.163
52.110.12.15
52.110.12.47
20.42.179.192
57.155.104.224
52.148.114.188
52.110.12.24
72.154.7.99

File paths

X:\:`:d:h:l:p:t:x:
E:\:d:
T:\:`:d:h:l:p:t:x:
X:\:`:d:h:x:
X:\:`:n:
V:\:b:h:n:t:z:
X:\:b:
X:\:`:

More QakBot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report