MALICIOUS — 9c080633933a258c787348d898b592a602b0e660463187bc9611c3d2e01f9b01

MALICIOUS — 9c080633933a258c787348d898b592a602b0e660463187bc9611c3d2e01f9b01 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Razy family. 9 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 9c080633933a258c787348d898b592a602b0e660463187bc9611c3d2e01f9b01
SHA-1: e0605a9ce18126abb37b1c6e5843f6fa3346aa4a
MD5: a3aff13f041a2425275e24f30970561d
imphash: 12a4d210f93ba8043687b0dfc003a8f9
ssdeep: 6144:1lfj4dhMo4GEeBVRot846iQ/5Dc6gvSve/eUsbVA:1lfsdhMo4BLdQ9c6gqvemNZA
TLSH: T17449D73B30884F96F299D5D8844B9D2CD0F34E4739E34AC0DD93E839758886B78199E6
Submitted as: 9c080633933a258c787348d898b592a602b0e660463187bc9611c3d2e01f9b01
File type: pe · Size: 414936 bytes
Verdict: malicious (100/100) · Family: Razy

Detections (9 of 56 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Adware.Razy-9853577-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
Microsoft Defender: PWS:Win32/QQpass!pz
Emsisoft (Emergency Kit): Trojan.GenericKD.48312657
Trellix Stinger (McAfee): PWS-FCCD!A3AFF13F041A
Kaspersky (KVRT): Trojan-PSW.Win32.QQPass.covz

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 20 weighted signals:

ClamAV (daily) flagged Win.Adware.Razy-9853577-0 (rule Win.Adware.Razy-9853577-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged PWS:Win32/QQpass!pz (rule PWS:Win32/QQpass!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.48312657 (rule Trojan.GenericKD.48312657) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PWS-FCCD!A3AFF13F041A (rule PWS-FCCD!A3AFF13F041A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-PSW.Win32.QQPass.covz (rule Trojan-PSW.Win32.QQPass.covz) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 4 external host(s) and 22 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://ui.ptlogin2.qq.com/cgi-bin/login?link_target=blank&appid=12000101&s_url=http://kf.qq.com/other/for_your_service.shtml, https://ssl.ptlogin2.qq.com/check?uin=, http://check.ptlogin2.qq.com/check?regmaster=&pt_tea=1&pt_vcode=0&uin= - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

46545 behavior events · 2 ATT&CK techniques · 18 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F263F63198568CED7739E17893D8775_CF1B4004AECEBF2DA58DF22FDCAD263F - aef820b4ffa53cb3c11bc353ac5c425fb0165eccd70940937135ef3c52a22fbb
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_3CCF1F7416183FA2C0782EA895E1F644 - 22753e682d408818faeb4101aebdf70fbc05e72ef89e779d4d3ce6711fd8aacf
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A406A0C16078CBE0C5819DA376FB1D88_FDD34BD2D7203B2A6C855CBE0C131919 - c0244c59f2fe25bd4c04cfb94a7f046a15124b247586cf16141f5761552cc135
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F263F63198568CED7739E17893D8775_CF1B4004AECEBF2DA58DF22FDCAD263F - 4f525fc9d67e8ded51f6d9589827d687a7378f1ced3593fde43b9f88026bad65
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_3CCF1F7416183FA2C0782EA895E1F644 - b0923764eb2dbfd34d55cb929455e2e24a8d6a6da1e487931dededdc29793f57
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD - 6e5d61504a166a1823436c4f5ce85141d00796212201ee89f389886a10eece35
C:\Users\analyst\AppData\Local\Temp\Syscaemhqlci.exe - 3216cb22aa3acf645db1406fda2cb0c6a877d8a261304e8c460dd10aff0f179d
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90AAF23DAA6D8340B032A583D2C7F22_61B0417EFCC1E188A9A251BF4E335520 - 196230b0aeb46c89f8269dde6cf9d4df8e9b934c4a00bf1eccb17ef54791c299
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A406A0C16078CBE0C5819DA376FB1D88_FDD34BD2D7203B2A6C855CBE0C131919 - cc95e3e4e421bf973e639e5a1965f12f56452527da98e64d039766e911ec4e1b
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B - 32f8d671be7a818b1344854c9a7f7b4cc645f151bda64d4a2ce3d0878c67a370
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A406A0C16078CBE0C5819DA376FB1D88_3413FA8BE0C4975E02C73FF3C3ED12AB - d37de647b83312a3f2b225b020cf46de66c25d64b884a3ba1452cb7512c10612
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD - 8ace3780192e9d9d27f504d0ee6a963e789e6c7bc2d94df0637bb422eaf075ed
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A406A0C16078CBE0C5819DA376FB1D88_3413FA8BE0C4975E02C73FF3C3ED12AB - 8861eebfcf2ca1d4e1cd0ca2f30dafaa77ba8ec51ce021520407f4b1ef1e5751
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B - 903657b1500e591c42ca0c2ab63010b373e0b7adee41c5221613880b0f3caf61
C:\Users\analyst\AppData\Local\Temp\Sysceamhqlci.exe - 8ee1589c3727e6c8b1d74f57bcd9dcb2f0f891c0c951a915e1e2e7b0d9057aaa

Embedded URLs

http://ui.ptlogin2.qq.com/cgi-bin/login?link_target=blank&appid=12000101&s_url=http://kf.qq.com/other/for_your_service.shtml
https://ssl.ptlogin2.qq.com/check?uin=
http://check.ptlogin2.qq.com/check?regmaster=&pt_tea=1&pt_vcode=0&uin=
http://i3.tietuku.com/b1bd23099c054744.jpg
http://cf.qq.com/other/cilent/index2.shtml
http://www.baidu.com/
http://captcha.qq.com/getimage?uin=
http://ptlogin2.qq.com/login?u=
http://aq.qq.com/cn2/index
http://my.pay.qq.com/cgi-bin/account/ajax_query.cgi?cmd=32&_=
http://my.pay.qq.com/cgi-bin/personal/balance_query_sortflow.cgi?_=
http://captcha.qq.com/getimage?aid=11000101&r=
http://my.pay.qq.com/cgi-bin/account/ajax_query.cgi?cmd=31&extcode=
http://pay.qq.com/ipay/index.shtml?c=xxxy&aid=pay.paygame.xx.outer&ch=qdqb
http://cf.qq.com/act/a20141214luxury/?ADTAG=client.btn.detail
http://i3.tietuku.com/d95480b8cd6b954b.png
http://i3.tietuku.com/801db876cdcaa96c.png
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA%2FgMquETQMxBsUMjhPIsGg%3D
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEATBuWAZH8q%2B3NqTAabNeMM%3D
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRdfbJlK8FvT8EKTy%2FQWk9HlJQmegQUKyMWgRtHiYqQeuzoMtRsjnL5ziUCEAkOVwQxGcjzFW8Ntx%2F%2BQkU%3D
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRdfbJlK8FvT8EKTy%2FQWk9HlJQmegQUKyMWgRtHiYqQeuzoMtRsjnL5ziUCEAgUONl4d97qMX0WMuCzj6I%3D
http://check.ptlogin2.qq.com/check?regmaster=&pt_tea=1&pt_vcode=0&uin=&appid=12000101&js_ver=10117&js_type=1&login_sig=&u1=http%3A%2F%2Fkf.qq.com%2Fgame%2Fbusiness.html%3Fcode%3Ddnf&r=0.746263534781356

Embedded domains

ui.ptlogin2.qq.com
kf.qq.com
ssl.ptlogin2.qq.com
check.ptlogin2.qq.com
i3.tietuku.com
cf.qq.com
www.baidu.com
captcha.qq.com
ptlogin2.qq.com
aq.qq.com
my.pay.qq.com
pay.qq.com
ocsp.digicert.cn

Embedded IP addresses

4.150.223.115
52.230.59.222
4.230.171.124
104.18.33.89
129.226.107.134
129.226.103.162
104.18.21.226
47.246.41.179
172.66.2.5
135.233.45.221
85.210.193.152
20.184.175.1
51.132.193.104
72.153.5.138
52.148.114.188
52.110.12.15
52.110.12.56

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report