Overview

overview

8

Static

static

6

[Dev] ¿á...QA.exe

windows7_x64

8

[Dev] ¿á...QA.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    __Q Air [_____].zip

  • Size

    5.4MB

  • Sample

    200807-22ncejf8ee

  • MD5

    1d9d4d633e35986a838c48f4330f02b4

  • SHA1

    426c9fd36d41c69e80d31d8d783710e6dad4f8ef

  • SHA256

    341a30be185f9984fc4fb3328b8846f97499259f35a6d98abe32532b2c2516af

  • SHA512

    fa67cbf2a48dc7706e268fb840a0151ac1dc96d6bfebca077d767ee3d083e79b8f822996497d3e14a70f9a2cca1070c44bac0df8b5ade9d8ad026737bb511909

Score
8/10

Malware Config

Targets

    • Target

      [Dev] ¿áQ Air [Õýʽ°æ]/¿áQ Air/CQA.exe

    • Size

      5.6MB

    • MD5

      6aa36f386a3e645f67cd6945374b8ea8

    • SHA1

      17f6d3dedfd6afe56135d3a2e7ae3a7d120151ca

    • SHA256

      39599008089755aa7cccb534b2c94ccb537f266018bb67ae3ed4b9f51c0a40b9

    • SHA512

      87f59bb1a8d6887fa967d811e2db70c2bfb9bf9673347c6bada2d03f1e3371fbe05e7853a063a90df71627f9ea803d83c71c89b88859199f5a28e2c05e38d706

    Score
    8/10

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Enumerates connected drives

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks