Overview

overview

8

Static

static

1

Qad.msi

windows7-x64

8

Qad.msi

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OCTL.zip

  • Size

    921KB

  • Sample

    231206-w7km6sbf47

  • MD5

    ac4abc816b89facfa185636d97d4cff2

  • SHA1

    9fe21b98da60d21fdc3989c748ef4f0fe3663ecb

  • SHA256

    0e659a64bff173950a25e17604c3c60deecdd3a8b5cf06a13a26b4fb73f78935

  • SHA512

    405b350b693d017d43b016f9eb5f22ac15e66a501718cf484d2cf8956086f0a121fa12f3b14368f3ed3bdc490845fb49bdeb4a9d24caa2df833cef97b7f14444

  • SSDEEP

    24576:eMmeUQfVNfIPEQ72fSk/btz17YZ3ns8eDb2oPvgk/MIQsrWEqA:rLtNfIce2ft/bR1EgPPT/MNsrWEqA

Score
8/10
dave

Malware Config

Targets

    • Target

      Qad.msi

    • Size

      1.1MB

    • MD5

      8beedcbe86a27207ddd05a1b322d45d9

    • SHA1

      feab6daf72c2796534ba80d7f3b99f0bc79bbf1c

    • SHA256

      040997c2b5de628062cd1f5007e56201a8ad1db741b1416092dedbc3d136bbe3

    • SHA512

      8c92382fc2a841384e7e0ea2baf05dafb9e9563b0cc1080bcb508c0842b7dab32e4c1e6356a61099e65dd126208fc137adce0dbf8e935012c118b6231372183e

    • SSDEEP

      24576:l5wnUeiNpNjv2PsQ67IzRNYZcE++dQoDvgW/MI2crW6w:Dgi3Nj+bMmhUtDD/MdcrW6w

    Score
    8/10
    dave

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks