Overview
overview
8Static
static
82008QQľ�...��.exe
windows7-x64
82008QQľ�...��.exe
windows10-2004-x64
82008QQľ�...��.htm
windows7-x64
12008QQľ�...��.htm
windows10-2004-x64
12008QQľ�...08.vbs
windows7-x64
12008QQľ�...08.vbs
windows10-2004-x64
12008QQľ�...��.url
windows7-x64
12008QQľ�...��.url
windows10-2004-x64
12008QQľ�...��.url
windows7-x64
12008QQľ�...��.url
windows10-2004-x64
12008QQľ�...��.url
windows7-x64
12008QQľ�...��.url
windows10-2004-x64
12008QQľ�...��.url
windows7-x64
12008QQľ�...��.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
2008QQľ/2008qqľ.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2008QQľ/2008qqľ.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
2008QQľ/77169.org˵.htm
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
2008QQľ/77169.org˵.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
2008QQľ/qq2008.vbs
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
2008QQľ/qq2008.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
2008QQľ/ĺڿͬ˽ѧѵ.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
2008QQľ/ĺڿͬ˽ѧѵ.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
2008QQľ/ĺڿͬ.url
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
2008QQľ/ĺڿͬ.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
2008QQľ/¿ƼIDC˾.url
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
2008QQľ/¿ƼIDC˾.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
2008QQľ/¿Ƽȫά.url
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
2008QQľ/¿Ƽȫά.url
Resource
win10v2004-20220812-en
General
-
Target
b7ff75fc5652e041146cc321ec490b1946b7788281269632506b201ce5a11045
-
Size
100KB
-
MD5
3629de29178e43ddb35b254b84bffd3c
-
SHA1
e4a5b34da724049c35e7afe9fcffcc12e021cfe6
-
SHA256
b7ff75fc5652e041146cc321ec490b1946b7788281269632506b201ce5a11045
-
SHA512
36d0858a89dadec468b8dd73163a1ab431918a9ee982d4a6c64575bd78d4acefaa0a0cc427ebbf8d103d0b9a941cd5a6c54ccd0ec7440ebc566fce796ed165af
-
SSDEEP
3072:dj7b7YKKnG9E6n9igYg4f0Ex+3C89OKiT0bRws6ip:djP8KKnG9TRYgrQ+3CgOKe0bRws68
Malware Config
Signatures
-
resource yara_rule static1/unpack001/2008QQľ/2008qqľ.exe upx
Files
-
b7ff75fc5652e041146cc321ec490b1946b7788281269632506b201ce5a11045.zip
-
2008QQľ/##ע##.txt
-
2008QQľ/2008qqľ.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
2008QQľ/77169.orgʹð˵.txt
-
2008QQľ/77169.org˵.htm.html
-
2008QQľ/qq2008.asp.vbs
-
2008QQľ/ ##ע##.txt
-
2008QQľ/ĺڿͬ˽ѧѵ.url.url
-
2008QQľ/ĺڿͬ.url.url
-
2008QQľ/¿ƼIDC˾.url.url
-
2008QQľ/¿Ƽȫά.url.url