qulab | f29903033ff296dbb07a3a869bd7c3b2f135e12ed1be227691040dfe5272677b

General

Target

f29903033ff296dbb07a3a869bd7c3b2f135e12ed1be227691040dfe5272677b
Size

6.3MB
Sample

220524-wvkseacfd3
MD5

607afb9f5a1de0e31d5cf6904e60a853
SHA1

ac99aafee4902a65c0185f9aab490da3b12b83ae
SHA256

f29903033ff296dbb07a3a869bd7c3b2f135e12ed1be227691040dfe5272677b
SHA512

356b77f7cd35abfae04149f1bde3f8b84affc6556e411edd9f4ced3355dfd70e9f3840818cfd89e57b94b6867babc20b896507ee4f32b13671ff934f67a0e797

Score

10^/10

Malware Config

Targets

- Target
  
  f29903033ff296dbb07a3a869bd7c3b2f135e12ed1be227691040dfe5272677b
- Size
  
  6.3MB
- MD5
  
  607afb9f5a1de0e31d5cf6904e60a853
- SHA1
  
  ac99aafee4902a65c0185f9aab490da3b12b83ae
- SHA256
  
  f29903033ff296dbb07a3a869bd7c3b2f135e12ed1be227691040dfe5272677b
- SHA512
  
  356b77f7cd35abfae04149f1bde3f8b84affc6556e411edd9f4ced3355dfd70e9f3840818cfd89e57b94b6867babc20b896507ee4f32b13671ff934f67a0e797
Score

10^/10

evasion spyware stealer themida trojan qulab discovery upx
- Qulab Stealer & Clipper
  Infostealer and clipper created with AutoIt.
  stealer qulab
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2