MALICIOUS — 4f54c6603e6dd00266c63b22abd05ae1fe129f169bceda579bf3b5da1aa79805

MALICIOUS — 4f54c6603e6dd00266c63b22abd05ae1fe129f169bceda579bf3b5da1aa79805 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the QQPass family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 4f54c6603e6dd00266c63b22abd05ae1fe129f169bceda579bf3b5da1aa79805
SHA-1: 240838e8360cffef4c1d079e7f5e26c05d2086e2
MD5: 62b0ad86df2d260271ac283650ba81b1
imphash: 435ddb61824cf7b0d9a2eafc9fb30194
ssdeep: 6144:/USiZTK40wbaqE7Al8jk2jcbaqE7Al8jk2jU:/UvRK4j1CVc1CVU
TLSH: T15247DF5819A1EBB4D1CB8C4BD824D7ECFA4BDC8D67B5790C011327B44B5A203D8A5B1B
Submitted as: 4f54c6603e6dd00266c63b22abd05ae1fe129f169bceda579bf3b5da1aa79805
File type: pe · Size: 348233 bytes
Verdict: malicious (100/100) · Family: QQPass

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Generic-9856964-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/QQPass!pz
Trellix Stinger (McAfee): Trojan-FFZL!43732BFF07AD
Kaspersky (KVRT): Trojan.Win32.Scar.oetk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Generic-9856964-0 (rule Win.Malware.Generic-9856964-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/QQPass!pz (rule Trojan:Win32/QQPass!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FFZL!43732BFF07AD (rule Trojan-FFZL!43732BFF07AD) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Scar.oetk (rule Trojan.Win32.Scar.oetk) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12991 behavior events · 1 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\qpath.ini - f67c7158d20b140c1ac3a1e911c02ad9221882a4d45da5977afe8d16f3523f77
C:\Users\analyst\AppData\Local\Temp\Sysqamqqvaqqd.exe - 8a11c3fe5383a862d6a46a7618b306400c3eecad4855f64751c453bd7808946f
C:\Users\analyst\AppData\Local\Temp\Sysqemwzsmk.exe - 1102c54aab01882824235e554f4b23a4abdb5d2421724bef1c43345d5d6b8c67
042ff38f8353dbbdbd296a817852bb2c046c21cfd682bda62c45098042c0be1c - 042ff38f8353dbbdbd296a817852bb2c046c21cfd682bda62c45098042c0be1c
47c75b1c57ca45ca2038122b998ee2de5217bb3e1615a7fa92a433a787992de1 - 47c75b1c57ca45ca2038122b998ee2de5217bb3e1615a7fa92a433a787992de1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ietuku.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.50.73.5
52.123.252.212
57.154.63.210
4.230.171.124
172.64.154.167
74.178.240.51
20.247.184.142
52.168.117.175
74.178.76.128
74.179.77.204
20.184.175.5
135.234.160.246
172.178.240.161
40.84.97.4
72.145.35.108
52.148.114.188
52.110.12.14

More QQPass samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report