quantum_locker.zip
- SHA256 652c394928687ed453c34befbbe373f78a0258a40b0f40db425ad232ad761b85
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
quantum_locker.zip
Resource
win7-20230220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
quantum_locker.zip
Resource
win10v2004-20230220-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
quantum_locker/quantum_locker.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
quantum_locker/quantum_locker.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target quantum_locker.zip
- Size 40KB
- Sample230608-dv79labe29
- SHA256 652c394928687ed453c34befbbe373f78a0258a40b0f40db425ad232ad761b85
- MD5 0bd28968ed0f67ce2614375594500133
- SHA1 0875087b078b92771f1ad635e211ec89dc7fbd86
- SHA512 a5f59cb600073e632580f08dd40ffceb8caf5515ade8e4d1af84e9ae4f4afa8c32c1fe10b02501dc28633df79b74f7deccb0ddb8c26d982cf1d1508e9598afcd
- SSDEEP 768:h/BTu9saraH7kFg3zxQZ/YbL5/TZQRfXkt3zx+8FFseey6b9C0DkfYUr6ahS/K:9BTEZFgo6TZM02ecb9HDkwUfd
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/quantum_locker/quantum_locker.sample
File Explorer
-
quantum_locker.zip.zip 40KB
-
quantum_locker/quantum_locker.sample.exe 75KB
quantum_locker/quantum_locker.sample
- IMPHASH 58373ffd0758633945b3da12825958c0
- SHA256 b63e94928da25e18caa1506305b9ca3dedc267e747dfa4710860e757d2cc8192
- MD5 0706764b3963df092079d3bdef787a1f
- SHA1 73c2460d59f3d0637523ca6d35425aae14358ba1
- SHA512 3af7ff3b2aa689eb4c410562b5ead74ff77417da941521928391c6fac3dcc6a75f6d866f52b12f67a41564cfa81afcda51857c0f208f9e90e8629e0f0b5d5cb4
- SSDEEP 1536:9aX51pVH9hsgNGLs6BLM1frxz/HTfcKKBaJGp:OfJGLs6BwNxnfTKsG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
Major OS version
Entry point
30368
Magic Number
523
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
oleaut32
SysAllocString
SysFreeString
mpr
WNetCancelConnection2W
WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW
WNetAddConnection2W
msvcrt
_wfopen
_vsnwprintf
memset
fgetws
feof
fclose
_getch
shlwapi
StrChrW
StrStrIW
StrCmpNIW
StrCmpIW
StrStrIA
SHRegSetUSValueW
advapi32
LookupAccountSidW
GetTokenInformation
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
StartServiceW
QueryServiceStatusEx
GetUserNameW
OpenServiceA
OpenSCManagerW
OpenSCManagerA
EnumServicesStatusA
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
netapi32
NetGetJoinInformation
NetShareEnum
NetApiBufferFree
NetGetDCName
kernel32
CopyFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
lstrcpyA
AllocConsole
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetFileAttributesW
DeviceIoControl
lstrcmpiW
OpenProcess
lstrcmpiA
GetModuleFileNameW
GetTempPathW
CreateProcessW
GetSystemInfo
GlobalMemoryStatus
GetComputerNameW
GetStdHandle
GetCurrentProcessId
TerminateProcess
GetComputerNameA
lstrlenA
TlsAlloc
SetErrorMode
ExitProcess
GetCommandLineW
RtlVirtualUnwind
HeapAlloc
GetProcessHeap
lstrcpyW
lstrcatW
lstrlenW
FindClose
FindFirstFileW
FindNextFileW
GetVolumeInformationW
GetLastError
HeapFree
CreateFileW
WriteFile
CloseHandle
SetLastError
HeapReAlloc
GetDriveTypeW
WideCharToMultiByte
Sleep
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcess
SetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
CreateThread
GetTickCount64
CreateSemaphoreA
ResetEvent
TerminateThread
GetFileSizeEx
ReadFile
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
TlsGetValue
TlsSetValue
DeleteFileW
activeds
ord9
user32
wsprintfW
ole32
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
ntdll
RtlGetVersion
ZwQuerySystemInformation
RtlGetNativeSystemInformation
shell32
CommandLineToArgvW
ord680
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.c
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.r
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.d
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE