MALICIOUS — 83b3085fe4f5564efc2159b7276cba851f044851c1e0ef15be66feec7cd1b001

MALICIOUS — 83b3085fe4f5564efc2159b7276cba851f044851c1e0ef15be66feec7cd1b001 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the QQpass family. 8 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 83b3085fe4f5564efc2159b7276cba851f044851c1e0ef15be66feec7cd1b001
SHA-1: 9ea73c3b463e91f5a3b33ef296d047ec7307e35b
MD5: de6e6e5f1f5045a80def6e92afbffc61
imphash: 6ae71f8563def1b7f1beb3f95b11ca83
ssdeep: 1536:ZGaq93mQy5PV4MSu4M3vfAlA89mWMMF4pzYU2qIUZ6kd+l1:Z5MaVVnLA0WLM0Uvh6kd+l1
TLSH: T1C23BDF144456EBB9C5C34C17C494D7EEFAABDCADAB31B89C924353386B84193E228353
Submitted as: 83b3085fe4f5564efc2159b7276cba851f044851c1e0ef15be66feec7cd1b001
File type: pe · Size: 102308 bytes
Verdict: malicious (100/100) · Family: QQpass

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:
ClamAV (daily): Win.Dropper.QQpass-7194329-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/QQPass!pz
Emsisoft (Emergency Kit): Gen:Variant.Stealer.223
Trellix Stinger (McAfee): PWS-FDIN!DE6E6E5F1F50
Kaspersky (KVRT): Trojan.Win32.Scar.oetk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Dropper.QQpass-7194329-0 (rule Win.Dropper.QQpass-7194329-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/QQPass!pz (rule Trojan:Win32/QQPass!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Stealer.223 (rule Gen:Variant.Stealer.223) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PWS-FDIN!DE6E6E5F1F50 (rule PWS-FDIN!DE6E6E5F1F50) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Scar.oetk (rule Trojan.Win32.Scar.oetk) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections: (rule high-entropy-sections:) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-sections:, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

62931 behavior events · 2 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\Sysqemcedyf.exe - b6302ddf6a8e7f2e3a656332700848e4784d0baa9317f4b083b9ab9258564736
C:\Users\analyst\AppData\Local\Temp\Sysqamqqvaqqd.exe - ec16f5681ef4798eb24430f5b54acb130dba64c81c75f401173fb5c9a895bd07
C:\Users\analyst\AppData\Local\Temp\Sysqemrhzik.exe - 828cd5e4c0311fe1d41e3ba7a903c7b05997423138d5297fd7d5db4feeaa7717
C:\Users\analyst\AppData\Local\Temp\qpath.ini - 278da4b544c74808011aaa64d9ccdf88e7dbc81b5031d758ce9b38e552bd015b
C:\Users\analyst\AppData\Local\Temp\Sysqemtxfec.exe - 6a31b8f5370e224332eb57b0b09ab7de4b233de7b8afb2dcaef23f8e40c9effa
caab0ec9fdb641e9b89019dbdb0ee26066a97b9a35c2bbd8cdcd6d964c92bb32 - caab0ec9fdb641e9b89019dbdb0ee26066a97b9a35c2bbd8cdcd6d964c92bb32
2aa1fe2ca2841775f9530dbe013a01c2ce6e832ded2264e1ed42cd8e2785217d - 2aa1fe2ca2841775f9530dbe013a01c2ce6e832ded2264e1ed42cd8e2785217d
7288bb83efc9646a2e76507199feef8d95589e9b22140690c5ea9dd2ad487688 - 7288bb83efc9646a2e76507199feef8d95589e9b22140690c5ea9dd2ad487688

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.89.1.12
4.230.171.124
20.42.179.204
40.84.97.4
20.247.184.197
135.232.92.137
74.178.240.51
20.184.175.1
74.178.76.128
172.66.2.5
20.184.175.9
13.89.179.15
135.234.160.246
52.110.12.28
52.110.12.33
52.148.114.188
72.153.5.139
52.110.12.52
52.110.12.50

More QQpass samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report