MALICIOUS — d2d4a2b8c204f7f94c63001ede9c4a140cdaf97b1540882e90b86125baba72a4
MALICIOUS — d2d4a2b8c204f7f94c63001ede9c4a140cdaf97b1540882e90b86125baba72a4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the QakBot family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
d2d4a2b8c204f7f94c63001ede9c4a140cdaf97b1540882e90b86125baba72a4 - SHA-1:
78593e5b0153234b5d6ef8defa46967bcbbe11e4 - MD5:
170cb150efc8da2a904eca45f980be06 - imphash:
9e62f3cd2189054f4bb90527a7ba86cc - ssdeep:
12288:OQyVN+P9loEP1BhI/XvnnRwe40F495OfUZjsAzZat6mIo:ZOEPkSTs5nTD817zZaP - TLSH:
T19B4DAE7F23277613DA37CE240991BF4E0071F86A10766C8953AB643EFAE9C5B1A44358 - Submitted as: d2d4a2b8c204f7f94c63001ede9c4a140cdaf97b1540882e90b86125baba72a4
- File type: pe · Size: 601088 bytes
- Verdict: malicious (100/100) · Family: QakBot
Detections (7 of 56 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Trojan.Qakbot-9908979-1
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Gen:Variant.Qbot.642
- Trellix Stinger (McAfee): Trojan-FTKL!170CB150EFC8
- Kaspersky (KVRT): UDS:Trojan.Win32.Injuke.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 11 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Qakbot-9908979-1 (rule
Win.Trojan.Qakbot-9908979-1) - engine signal, weight 0.90, confidence 0.95 - Extracted QakBot config (1 C2) - engine signal, weight 0.80, confidence 0.90
- Microsoft Defender flagged flagged (rule
flagged) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Qbot.642 (rule
Gen:Variant.Qbot.642) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Trojan-FTKL!170CB150EFC8 (rule
Trojan-FTKL!170CB150EFC8) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.Win32.Injuke.gen (rule
UDS:Trojan.Win32.Injuke.gen) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 1 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
159 behavior events · 0 ATT&CK techniques · 6 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- tas02.sls.update.microsoft.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
Dropped files
- 9281e5204bded043cb9fa678fa7378308f6040a59a961ed676d16de7b8dd1013 -
9281e5204bded043cb9fa678fa7378308f6040a59a961ed676d16de7b8dd1013 - 943794a0cebf67ab57a09cd40718bba1a6c5a3e96ae3f3ed53f8fb6dc17185a4 -
943794a0cebf67ab57a09cd40718bba1a6c5a3e96ae3f3ed53f8fb6dc17185a4 - 4178866b5ff2bc151d2e341df91bdcd292faecb0da910fc1ce3443fd41349fd5 -
4178866b5ff2bc151d2e341df91bdcd292faecb0da910fc1ce3443fd41349fd5 - fd7aa8afb7ec3930dbb6ea2b4ee18b3865ed42bb9a208ac4f5e003598f455532 -
fd7aa8afb7ec3930dbb6ea2b4ee18b3865ed42bb9a208ac4f5e003598f455532 - be30dbeb4be5c912417028487b17bfca5ebbd466e7a15b1f1e95cf2d2bdc8989 -
be30dbeb4be5c912417028487b17bfca5ebbd466e7a15b1f1e95cf2d2bdc8989 - 213df45013522f334215d737ff2eef22480035aa744ae8ad7fbd916c27f178d6 -
213df45013522f334215d737ff2eef22480035aa744ae8ad7fbd916c27f178d6
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 4.150.223.103
- 20.247.184.197
- 57.155.101.212
- 4.230.171.124
- 57.154.63.210
- 135.233.95.144
- 74.178.76.54
- 4.150.223.111
- 20.42.65.84
- 135.234.160.246
- 4.150.223.113
- 52.110.12.55
- 52.110.12.42
- 52.110.12.2
File paths
- T:\:d:l:t:
- O:\:k:
- X:\:`:d:h:l:p:t:x:
- I:\:`:o:{:
- W:\:a:l:q:v:
- X:\:`:d:r:
- X:\:`:d:h:l:p:x:
More QakBot samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report