MALICIOUS — d1b228b1c037e1f925d43a81bc8a086d098434255482beeba7f83b2a93bf4315

MALICIOUS — d1b228b1c037e1f925d43a81bc8a086d098434255482beeba7f83b2a93bf4315 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Qwhxtp family. 3 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: d1b228b1c037e1f925d43a81bc8a086d098434255482beeba7f83b2a93bf4315
SHA-1: 081be69b6a914864073cbf990ee707b8a4b93739
MD5: 8f4afd604ce3b16bf35737aa9af32760
imphash: 875a02aa1935ecde4dd6567810e1c9f1
ssdeep: 6144:+6bso6hrSfDOKwLcveYSuI0uLx6YACX5HSbuacD9jz7KVo2PHPAk8HscHSTx6Ft:+M6XWeYSuK0ihW/cpu3ARMcyTxs4CmP
TLSH: T1DD4C8C2141132A23E5FBED18AC1159FDC022B5BC60B4A8AE5743EC9D80E9E33D5F26D5
Submitted as: d1b228b1c037e1f925d43a81bc8a086d098434255482beeba7f83b2a93bf4315
File type: pe · Size: 528384 bytes
Verdict: malicious (89/100) · Family: Qwhxtp

Detections (3 of 55 engines)

capa (capabilities): capability:collection/keylog
YARA: ESET research: coruscant
Kaspersky (KVRT): UDS:Trojan.Win64.Agent.qwhxtp

MITRE ATT&CK

Why this verdict

The malicious score of 89/100 is the fusion of 8 weighted signals:

Memory forensics: 3 finding(s), e.g. RWX/private injected region in tsk_9eedb63045 (pid 4308) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 20 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: ESET research flagged coruscant (rule coruscant) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://auther.quarc.me/v2, https://curl.haxx.se/docs/http-cookies.html, 1.101.3.4 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

36 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://auther.quarc.me/v2
https://curl.haxx.se/docs/http-cookies.html
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787873793&P2=404&P3=2&P4=Ju1aX09lbsllwzxCMqjOknxh4aEZiGtbnX5mcKTGNmhGTzNRty63BoUbethXVxaDUzToK5cILjDhHYDGo5Vfxw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787873864&P2=404&P3=2&P4=mpgCy5AKlOCa%2flEXurtyqjVMAU5ed6Wn9NPuF7%2fRwHJ3fYgTHphRpB75GRd6QM%2b%2bkk4%2fnK4VTkO5K5s03Ds1dg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

auther.quarc.me
curl.haxx.se
example.com

Embedded IP addresses

1.101.3.4
20.42.73.27
4.247.188.224
20.247.184.142
4.230.171.124
74.178.240.61
4.150.223.101
135.232.92.97
20.236.44.162
40.99.133.226
52.123.128.14
40.99.134.18
52.123.252.243
172.178.240.161
74.178.232.29
203.26.79.13
52.148.114.188
4.247.188.233
72.145.35.100
52.110.12.30
52.110.12.37

File paths

C:\Windows\SysWOW64\windows64x.dll
C:\Windows\SysWOW64\windows32x.dll
C:\Users\Dark\Desktop\easy_loader-main\x64\Release\loaderFree.pdb

More Qwhxtp samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report