MALICIOUS — virussign.com_9f69b51512aac62a8c3065c37711fd00.vir

MALICIOUS — virussign.com_9f69b51512aac62a8c3065c37711fd00.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the QQpass family. 8 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 290ad179327d764cc58960f82db5cf383603913253beb65d81d8fb560fe5a04a
SHA-1: 28ede81a021dbf2a69a814e808099a44dfb63664
MD5: 9f69b51512aac62a8c3065c37711fd00
imphash: 6ae71f8563def1b7f1beb3f95b11ca83
ssdeep: 1536:A9wGaq93mQy5PV4MSu4M3vfAlA89mWMMF4pzYU2qIUZ6kd+lk2:A9w5MaVVnLA0WLM0Uvh6kd+lX
TLSH: T14739E0184456E7BAC5C34C17C490D7DEFAABDCADAB31B89C924313786B84593E228353
Submitted as: virussign.com_9f69b51512aac62a8c3065c37711fd00.vir
File type: pe · Size: 88149 bytes
Verdict: malicious (99/100) · Family: QQpass

Detections (8 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:
ClamAV (daily): Win.Dropper.QQpass-7194329-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Petite
Microsoft Defender: Trojan:Win32/QQPass.G!MTB
Emsisoft (Emergency Kit): Gen:Variant.Stealer.223
Trellix Stinger (McAfee): Trojan-FFZL!2BB9705769B2
Kaspersky (KVRT): Trojan.Win32.Scar.oetk

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Dropper.QQpass-7194329-0 (rule Win.Dropper.QQpass-7194329-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (QQpass): Sysqemziyir.exe - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Petite (rule DIE:Petite) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-sections:, Petite - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9961 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\Sysqemziyir.exe - 363ae93d7ab094b42dd1f480faaaceb98d3fef70beaa59346e0c859d8c1ea796
C:\Users\analyst\AppData\Local\Temp\Sysqamqqvaqqd.exe - 1f98571d649411ece2ea8cf4f8c37733b669d61c6b7ef8dc24c36bbd42899f3e
C:\Users\analyst\AppData\Local\Temp\qpath.ini - 2dc9b08d4b6db2c00d2a4bf92e4d8a723507cf6abb8d78b5e14a9ff454694904
2aa1fe2ca2841775f9530dbe013a01c2ce6e832ded2264e1ed42cd8e2785217d - 2aa1fe2ca2841775f9530dbe013a01c2ce6e832ded2264e1ed42cd8e2785217d
c3687efe2ef55d1c0aa4e8ec5e18ae9649ed111c552b488edf10f62e10904ad5 - c3687efe2ef55d1c0aa4e8ec5e18ae9649ed111c552b488edf10f62e10904ad5
7288bb83efc9646a2e76507199feef8d95589e9b22140690c5ea9dd2ad487688 - 7288bb83efc9646a2e76507199feef8d95589e9b22140690c5ea9dd2ad487688

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787669878&P2=404&P3=2&P4=VQQCIRINhzpsKEZBq%2f0b568BURmgKSKclqiV2KtImFk7QxOMl%2fUSf9bZB0NFhd9dy4zSiZJxp%2f5HakyjCVlAZQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787669954&P2=404&P3=2&P4=Mq0s1IlJqo0kwuLuyd0521wzfemKLfOmYV%2fcUOFihb9XHsloMx9AtrvHnMcpfbsKQlJ9psdXlZ2eGbnDIUThiA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.6
57.155.101.212
4.230.171.124
57.154.63.210
20.247.184.142
74.179.77.204
104.46.162.230
20.165.94.54
20.236.44.162
52.123.128.14
52.123.129.14
20.184.175.17
203.26.79.13
20.165.94.46
52.123.252.226
135.233.45.223
172.66.2.5
135.234.160.246
52.148.114.188
172.178.240.163
20.184.175.12
4.150.223.104
72.153.5.63
92.223.78.30
52.110.12.16

More QQpass samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report