MALICIOUS — 831b1446bb39d3fa83fc16dca17a9b48e1851a4aedc61e9e14289e5114994a6f

MALICIOUS — 831b1446bb39d3fa83fc16dca17a9b48e1851a4aedc61e9e14289e5114994a6f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Jqxm family. 4 of 55 detection engines flagged it, exhibiting 8 ATT&CK techniques.

Identification

SHA-256: 831b1446bb39d3fa83fc16dca17a9b48e1851a4aedc61e9e14289e5114994a6f
SHA-1: cc2701c258a412a41eda0446f8c763cd762a6e4d
MD5: 79403afc181af6d819c0c88ae57de5bf
imphash: e9bc693e38f224fee64f6fb70714114d
ssdeep: 384:E3eDES+/xwGkRKJR7lM61qmTTMVF9/q5J0:bQS+ZfbJxO8qYoA2
TLSH: T14C2CF8CD5339B159C9B8C0C7688C8ECC50A76F70F56E0B4AC105E62863FB9275D72A58
Submitted as: 831b1446bb39d3fa83fc16dca17a9b48e1851a4aedc61e9e14289e5114994a6f
File type: pe · Size: 24576 bytes
Verdict: malicious (99/100) · Family: Jqxm

Detections (4 of 55 engines)

ClamAV (daily): Win.Downloader.Jqxm-9876004-0
Microsoft Defender: Trojan:Win32/Zbot!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JQXM
Kaspersky (KVRT): Trojan.Win32.Fsysna.hzvk

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Downloader.Jqxm-9876004-0 (rule Win.Downloader.Jqxm-9876004-0) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

8512 behavior events · 3 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe - 735f21262ae8b17530d9416d8b524210725b150e662cb49cf8973d6d8bcaca88
C:\Windows\Temp\flash.log - fda6ad7e397d35ac990489e2082d90ba91b821b1f64c80d64668f0daa258b7cc

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787865971&P2=404&P3=2&P4=BDPFK%2bN1JMkKjWOtocvDsHQ2iN%2bhs7Fs7YEL4HB6FcLgcNZTNAfqwYTtiJQcs2SjGzjtd4Iqg1WZxWuHD7QoEw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.kvic.jp

Embedded IP addresses

40.79.141.153
52.123.252.233
52.253.84.76
4.247.188.224
4.230.171.124
48.211.4.16
135.233.95.144
135.232.92.97
20.42.73.25
20.231.239.246
52.123.128.14
52.123.129.14
40.99.133.210
40.79.141.152
172.215.188.232
135.233.45.223
52.168.117.170
203.26.79.13
52.110.12.40
52.110.12.26
52.148.114.188
135.233.95.80
72.145.35.107
52.110.12.20
52.110.12.10

File paths

c:\windows\system32\Macromed\Flash\FlashInstall.log

More Jqxm samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report