MALICIOUS — 7452b166279a56f68dc23e86ae5008f030304ae6505f6ced481b6ae099084f1c

MALICIOUS — 7452b166279a56f68dc23e86ae5008f030304ae6505f6ced481b6ae099084f1c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Qqpass family. 8 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 7452b166279a56f68dc23e86ae5008f030304ae6505f6ced481b6ae099084f1c
SHA-1: 064a233a36d1d7549dfb1a995d465cab8a7c4d8b
MD5: ec3d508318166355b1b5ea73605b3f37
imphash: ef85ed22de7ec9518877dc2b5979f64e
ssdeep: 6144:qb9iXkv6DOSCyJFDVhtc9HZlXqBLLXP1MxH:qb9EkKFFXtIHCje
TLSH: T1FF4323510736AE6FDFA82957D295D22CC0178075293B472A4855833B99DBC33B2FA3C8
Submitted as: 7452b166279a56f68dc23e86ae5008f030304ae6505f6ced481b6ae099084f1c
File type: pe · Size: 224312 bytes
Verdict: malicious (100/100) · Family: Qqpass

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Malware.Qqpass-9938956-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: PWS:Win32/QQpass.7002
Emsisoft (Emergency Kit): Gen:Variant.Genie.1303
Kaspersky (KVRT): Trojan.Win32.Reconyc.fxms

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Qqpass-9938956-0 (rule Win.Malware.Qqpass-9938956-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged PWS:Win32/QQpass.7002 (rule PWS:Win32/QQpass.7002) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Genie.1303 (rule Gen:Variant.Genie.1303) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Reconyc.fxms (rule Trojan.Win32.Reconyc.fxms) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged ASPack (rule ASPack) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: ASPack, high-entropy-sections:CODE,DATA,.idata, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 9 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1013 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\ThreatLens\BYSLGJO.EXE - 59bc2f25187951dd90200c25076ee40f5be49156c88891c8624bf10a3cd79ddd
C:\PerfLogs\svchost.exe - 2e697617b4c8614cd64c2d42d28bb2dd1faa3f36f5495d1104096b21e353c50b
C:\Config.Msi\svchost.exe - 7e23933da170a345a56d8469d62c787b926369ab77ab8d98e39eef372a131cfb
43c82cbeb08a27ede409f5c3b7a178c33c28bd256bacbf560543254e32566bdc - 43c82cbeb08a27ede409f5c3b7a178c33c28bd256bacbf560543254e32566bdc
C:\Program Files (x86)\ETUPUG.EXE - e351a79cf406d2a4a946d7294cfe8d8a75f165873917be21a14c77f164e3a783
C:\ThreatLens\UKGVZJZ.EXE - 8a31420c7c570d3cf2483a2d141438fb9859bf2fce028664d48f3d259b4f99dc
C:\Windows\System32\Ms7002.dll - f0a7ec2edff7699e546221808f45ca8816a75eb519618283d7c4514dfb9134e0
C:\filedebug - 0369394d7c4fb29865e6d625d793a340c29050eb45140af85c3090605ee4dd4e
C:\PerfLogs\AZJEB.EXE - 37d756fea2794b024cc8de3ad4857398e9a29a5476211699a9c4993d451a539c
C:\Windows\System32\KHTTX.EXE - 2e8405c875ede21b9b8194d5c92128c91e86f7876edce09389291c70c06ac014
C:\PerfLogs\XEXOQ.EXE - 2fed685d037cc32bcab81ddef8b6300fef465434866baf06455f8dfbacf66897

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.96
20.42.179.204
52.123.252.215
20.247.184.197
4.230.171.124
74.179.77.164
13.89.179.15
20.165.94.63
51.105.71.137
74.179.77.204
52.123.252.204
74.178.232.29
52.123.252.192
52.110.12.51
57.154.63.210
52.168.117.175
20.50.201.206
72.153.5.128
92.223.78.30
52.148.114.188
52.110.12.33
52.110.12.21

More Qqpass samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report