MALICIOUS — 6797ec28ca9e48a6e8f42e34459859a33c5f3232ce56172b6fbbce05983880b4
MALICIOUS — 6797ec28ca9e48a6e8f42e34459859a33c5f3232ce56172b6fbbce05983880b4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the QQpass family. 7 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
6797ec28ca9e48a6e8f42e34459859a33c5f3232ce56172b6fbbce05983880b4 - SHA-1:
9cae26c607a2c3e560b01026668fa042925527d4 - MD5:
814cd3406490de091fdd7b090ef6a2ea - imphash:
4f564f683b4d357f9444a0ee822b8d8e - File type: pe · Size: 4299168 bytes
- Verdict: malicious (97/100) · Family: QQpass
Detections (7 of 52 engines)
- ClamAV (daily): Win.Dropper.QQpass-9904690-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Trellix/McAfee ATR: ATR_BlackCat_ALPHV
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- LIEF (executable format parser): lief:invalid-authenticode
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
- Microsoft Defender: Trojan:Win32/Prepscram!pz
MITRE ATT&CK
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://schemas.microsoft.com/SMI/2016/WindowsSettings
- https://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-cs-g1.crl05
- http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
- http://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- http://www.microsoft.com/exporting
- https://www.mendeley.com/library
- https://service.elsevier.com/app/answers/detail/a_id/22094/kw/migrate/supporthub/mendeley/
- http://support.mendeley.com/customer/portal/articles/227955
- http://p.yusukekamiyamane.com/
- https://citationstyles.org
- https://github.com/Juris-M/citeproc-js
- https://plasma.kde.org
- https://www.zotero.org/
- https://rrchnm.org/
- https://www.gmu.edu/
- https://www.elsevier.com/legal/elsevier-website-terms-and-conditions
- https://www.elsevier.com/legal/privacy-policy
- http://citationstyles.org/
- https://github.com/citation-style-language/styles
- https://csl.mendeley.com
- http://creativecommons.org/licenses/by-sa/3.0/
Embedded domains
- schemas.microsoft.com
- cacerts.digicert.com
- crl4.digicert.com
- crl3.digicert.com
- www.digicert.com
- www.microsoft.com
- www.mendeley.com
- service.elsevier.com
- support.mendeley.com
- p.yusukekamiyamane.com
- citationstyles.org
- github.com
- plasma.kde.org
- www.zotero.org
- rrchnm.org
- www.gmu.edu
- www.elsevier.com
- csl.mendeley.com
- creativecommons.org
- mendeley.com
- domain.com
- www.w3.org
- ns.adobe.com
- msdn.microsoft.com
- valvesoftware.com
Embedded IP addresses
- 10.3.4.1
- 5.2.3.5
- 1.101.3.4
Registry keys
- HKLM\System\CurrentControlSet\Control\Session
- HKEY_CURRENT_USER\Software\Classes
- HKEY_LOCAL_MACHINE\Software\Classes
- HKLM\Software\Microsoft\Windows
- hklm\software
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
- HKLM\SOFTWARE\%sMicrosoft\Windows
File paths
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\MainWindow.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\ImportExportDialogProvider.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\AnnotationsExportSettingsDialog.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\FileListEdit.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\DocumentEditor.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\JSDataStore.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\JSNetworkResponse.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\RecommenderViewPresenter.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\SearchFilterPresenter.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\PeopleTextEdit.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\WebEnginePage.cpp
- c:\long
- c:\buildslave\steam_rel_client_win32\build\src\public\tier1\utlstring.h
- c:\buildslave\steam_rel_client_win32\build\src\common\crypto_textencode.cpp
- c:\buildslave\steam_rel_client_win32\build\src\public\tier1\utlvector.h
- c:\buildslave\steam_rel_client_win32\build\src\common\keypair.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\crypto_25519_donna.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\crypto_digest_openssl.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\crypto_rsa_openssl.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\enum_names.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\globals.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\keyvaluesignature.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\opensslwrapper.cpp
- D:\SAMSUNG\DeXonPC_Extern\cryptopp_8_2_0\sha_simd.cpp
- D:\SAMSUNG\DeXonPC_Extern\cryptopp_8_2_0\rijndael_simd.cpp
More QQpass samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report