MALICIOUS — 4daaa8c721d73c4e924ef31e2c9d17eb164e28c583b78cd291e9463bac26bcdd

MALICIOUS — 4daaa8c721d73c4e924ef31e2c9d17eb164e28c583b78cd291e9463bac26bcdd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Jqxm family. 4 of 56 detection engines flagged it, exhibiting 8 ATT&CK techniques.

Identification

SHA-256: 4daaa8c721d73c4e924ef31e2c9d17eb164e28c583b78cd291e9463bac26bcdd
SHA-1: 1940820b2b70c1275333e30e1a1e4bf0768bbfc6
MD5: 7607b82deb7fb5053b7e36aedb686326
imphash: e9bc693e38f224fee64f6fb70714114d
ssdeep: 384:E3eVES+/xwGkRKJrYINlM61qmTTMVF9/q5OzJ0:bGS+ZfbJcINO8qYoAN
TLSH: T1522C09D9133DB159CAB8D083288C8DCC60A76F70F56E1B4AC105E62863FB9375DB1A18
Submitted as: 4daaa8c721d73c4e924ef31e2c9d17eb164e28c583b78cd291e9463bac26bcdd
File type: pe · Size: 24576 bytes
Verdict: malicious (100/100) · Family: Jqxm

Detections (4 of 56 engines)

ClamAV (daily): Win.Downloader.Jqxm-9876004-0
Microsoft Defender: Trojan:Win32/Zbot!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JQXM
Kaspersky (KVRT): Trojan.Win32.APosT.pm

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Downloader.Jqxm-9876004-0 (rule Win.Downloader.Jqxm-9876004-0) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s) across 3 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.66, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Zbot!pz (rule Trojan:Win32/Zbot!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JQXM (rule Trojan.Downloader.JQXM) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.APosT.pm (rule Trojan.Win32.APosT.pm) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

8953 behavior events · 3 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Windows\Temp\flash.log - c49f45f6be9498eb942dab35a11898aba954095c6bd7a52e2fde3a8433047ae4
C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe - 62df82be7ab706cf95e159babdf59c1113ab645290a9473095937a7a72aceaf1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.kvic.jp

Embedded IP addresses

20.184.175.16
4.230.171.124
4.247.188.233
52.230.60.54
104.18.33.89
74.178.240.51
20.165.94.63
104.208.16.94
74.178.240.61
135.234.160.244
4.150.223.108
20.42.65.94
72.145.35.103
52.148.114.188
52.110.12.24

File paths

c:\windows\system32\Macromed\Flash\FlashInstall.log

More Jqxm samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report