MALICIOUS — 69f853a8f3b3b739e5603672aedb48db91a85dbe50ce1651ecad49a53b9bb908

MALICIOUS — 69f853a8f3b3b739e5603672aedb48db91a85dbe50ce1651ecad49a53b9bb908 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the QQPass family. 8 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 69f853a8f3b3b739e5603672aedb48db91a85dbe50ce1651ecad49a53b9bb908
SHA-1: 9451ee3699ffffe53f484dbd4fe87b117284a737
MD5: fd79df66905a36875cb28812d84ce443
imphash: 435ddb61824cf7b0d9a2eafc9fb30194
ssdeep: 1536:bOYjIyeC1eUfKjkhBYJ7mTCbqODiC1ZsyHZK0FjlqsS5eHyG9LU3YG8nO+:fdEUfKj8BYbDiC1ZTK7sxtLUIGU
TLSH: T18139F0481691D7BDE1CB8D1BDA24C7EDBD83EC5A2B35394D891213A20F59013DD28B2B
Submitted as: 69f853a8f3b3b739e5603672aedb48db91a85dbe50ce1651ecad49a53b9bb908
File type: pe · Size: 90011 bytes
Verdict: malicious (100/100) · Family: QQPass

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Generic-9856964-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/QQPass!pz
Emsisoft (Emergency Kit): Gen:Variant.Stealer.229
Trellix Stinger (McAfee): Trojan-FFZL!4B602352450D
Kaspersky (KVRT): Trojan.Win32.Scar.oetk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Generic-9856964-0 (rule Win.Malware.Generic-9856964-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/QQPass!pz (rule Trojan:Win32/QQPass!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Stealer.229 (rule Gen:Variant.Stealer.229) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FFZL!4B602352450D (rule Trojan-FFZL!4B602352450D) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Scar.oetk (rule Trojan.Win32.Scar.oetk) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

14809 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\Sysqamqqvaqqd.exe - 4ea7064ab9bb31a8981fd444643f20fda089b844fcb7f358e78b4fc18b82218c
C:\Users\analyst\AppData\Local\Temp\qpath.ini - bfbbfd0a808d73e137ce1c9207d92495e3005cac515709412d9dc68f73da7f1c
C:\Users\analyst\AppData\Local\Temp\Sysqempqfah.exe - 38965776d43420aad236593ecfd516f5c1db539c7fea6e28e42727c11d34f6dd
05f410b00d363ffd08358111e684595514e53fe08c508cb67797b29454d816d4 - 05f410b00d363ffd08358111e684595514e53fe08c508cb67797b29454d816d4
e83dcc2ee679ece49173ec6bbbd1c611c70f608a7a012fbb0f7abea42855322b - e83dcc2ee679ece49173ec6bbbd1c611c70f608a7a012fbb0f7abea42855322b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ietuku.com
oneclient.sfx.ms

Embedded IP addresses

20.42.65.91
57.155.104.224
4.230.171.124
20.247.185.124
74.178.240.51
104.46.162.229
135.233.95.144
104.18.33.89
4.150.223.102
74.179.77.204
135.234.160.246
52.148.114.188
52.182.141.63
40.84.85.40
104.208.16.94
20.42.65.85
52.123.128.14
172.172.255.218
72.153.5.136
52.110.12.37
52.110.12.51

More QQPass samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report