MALICIOUS — e98c3a0bc98ec4a284fcef081b102e3c577d9478d899fa20366ff8d264385940

MALICIOUS — e98c3a0bc98ec4a284fcef081b102e3c577d9478d899fa20366ff8d264385940 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the QQPass family. 8 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: e98c3a0bc98ec4a284fcef081b102e3c577d9478d899fa20366ff8d264385940
SHA-1: f64accc1ee523abf21628000b68f5f84dbbfd3c2
MD5: fe0d97ff6d7db3897d3d33f250a18ebc
imphash: 435ddb61824cf7b0d9a2eafc9fb30194
ssdeep: 3072:adEUfKj8BYbDiC1ZTK7sxtLUIGcly6aqOn7ACE89zMfo0z3P:aUSiZTK40wbaqE7Al8jkf
TLSH: T10640E09815A2DBB8E1CB8D0BD824C7EDF987EC8E2775390C451327B40B5A203D964B5B
Submitted as: e98c3a0bc98ec4a284fcef081b102e3c577d9478d899fa20366ff8d264385940
File type: pe · Size: 179110 bytes
Verdict: malicious (99/100) · Family: QQPass

Detections (8 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Generic-9856964-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/QQPass!pz
Emsisoft (Emergency Kit): Gen:Variant.Stealer.229
Trellix Stinger (McAfee): Trojan-FFZL!256442600CEC
Kaspersky (KVRT): Trojan.Win32.Scar.oetk

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Generic-9856964-0 (rule Win.Malware.Generic-9856964-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

36573 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\qpath.ini - 4965b6b67b3662d45edcf44d0a7660c389408335be60353cb5a9f56455563eb5
C:\Users\analyst\AppData\Local\Temp\Sysqamqqvaqqd.exe - 0706352187cee42890ca0426ff18d79fecc2d44a9821dc430553984f9bf08c98
C:\Users\analyst\AppData\Local\Temp\Sysqemsigya.exe - 20b7467d550a5f6effb63ecf6d45c6645478ed5acf7171813ff07b845591db32
C:\Users\analyst\AppData\Local\Temp\Sysqemrsujd.exe - 5af377a47850d92baf359db2cb01a16fd8beebd07d784ce1afb597f9de3e9e20
b134129fc002b03462967b71d99c5a29825dbfd4f29d74920c36492334f9d49a - b134129fc002b03462967b71d99c5a29825dbfd4f29d74920c36492334f9d49a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787888511&P2=404&P3=2&P4=dyan7cgS%2bSQakXkSqZa1I%2f4vvSnjWddSC8NiSJXyKTDy1I4W3TyNh8VOKBGRrs2O4LNblN81gHhm7b5Wkdy1sw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ietuku.com

Embedded IP addresses

20.42.179.204
4.230.171.124
52.168.117.170
4.144.132.114
85.210.193.152
135.233.95.144
20.165.94.54
20.184.175.23
135.232.92.137
52.123.129.14
20.112.250.133
40.99.134.18
52.123.128.14
51.105.71.136
135.233.45.221
92.223.78.30
52.148.114.188
135.233.45.223
203.26.79.13
74.178.232.29
85.210.196.11
52.182.143.212
72.153.5.137
52.110.12.2
52.110.12.10

More QQPass samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report