Quantum-Private[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Quantum-Private.zip
Size 18.9MB
Sample240328-c6dnpadc9s
SHA256 18994b1cd85550a5e702d7accd7daf7fa2d7208eb1526d35c58eca692c79f312
MD5 e010a0352bccb799ad3cc3f5a1d8b3e5
SHA1 d10369ad1e882ec6752cd7fd52e23a576e948591
SHA512 6555937e0b827ebce8fd072f0b247f36e7d8d678f2afe5a513d2c45e95a0b5cbd7dd3ca3c1c85adf704211e1aa1e0b9fde410a1e799de0c7a5ab107ac7d08369
SSDEEP 393216:3+FMfyYddY8pMlR5njm5SpwTevT1m91GsgsY9JVvTHrLq2Pk:3gMfTMlTnjm58vhm9ssSRvTHrLq2Pk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Quantum-Private/QuantumLoader.exe
unpack001/Quantum-Private/QuantumRunningAgent.dll

File Explorer

Quantum-Private.zip

.zip 18.9MB
Quantum-Private/QuantumLoader.exe

.exe 18.5MB
Quantum-Private/QuantumRunningAgent.dll

.dll 924KB

Quantum-Private.zip

SHA256 18994b1cd85550a5e702d7accd7daf7fa2d7208eb1526d35c58eca692c79f312
MD5 e010a0352bccb799ad3cc3f5a1d8b3e5
SHA1 d10369ad1e882ec6752cd7fd52e23a576e948591
SHA512 6555937e0b827ebce8fd072f0b247f36e7d8d678f2afe5a513d2c45e95a0b5cbd7dd3ca3c1c85adf704211e1aa1e0b9fde410a1e799de0c7a5ab107ac7d08369
SSDEEP 393216:3+FMfyYddY8pMlR5njm5SpwTevT1m91GsgsY9JVvTHrLq2Pk:3gMfTMlTnjm58vhm9ssSRvTHrLq2Pk
MD5 SHA1 SHA512 SSDEEP

Quantum-Private/QuantumLoader.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 69d4495345c95506405428ad52dd912680c9378f8471d75369b3551f562a6624
MD5 858746dfe88a1584ff3e20a2b5f3674d
SHA1 c8ae947f468dd0d15e7f9a4e459740cb16760efd
SHA512 1dba7e7fb17c98dbf97910601754160341d183b573e197c453bbb59287f73de0125dc0743436477956c47aa732256d304b2afa46e9d0eff887301d272b37bf7d
SSDEEP 393216:i76jW8RLSKD4Bx53TCzonobwNJhU/XuqoIKxJrFztRDs0:06jp4Bv3TCzoNLU/eqg7FztRDs0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19338846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Quantum-Private/QuantumRunningAgent.dll

IMPHASH 38866c0bc4c844181287986d18ee99bb
SHA256 efb80e7fc59775068ec3cbef99b0dd7f84916d3b22edf65a26b5363334f2ba5f
MD5 b8f198a305864534a2eaa2b91cfb9a96
SHA1 3abea6c16521d2336faff9dae5a8515a29fe3155
SHA512 d33cfb73c4bc9f69d173dd945ecdb68f22786c06bb2e00ec8874b688ff6cdc285be5a77c6babdde103775fb250ed50f974211da9984ca87baff4980451abc971
SSDEEP 24576:x0DTEOHdQWW9OVWXcK8YNOMKZQJpMZ2Zrn9:6DTTCW3yA9MWQjo6n
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

510796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\frgli\source\repos\GMod-SDK\x64\Release\GMod-SDK.pdb

kernel32

GlobalAlloc GlobalFree GlobalLock GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcess K32GetModuleInformation FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW GetFileAttributesExW GetProcAddress CloseHandle GetLastError Sleep GetModuleHandleA GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleW VirtualProtect AreFileApisANSI CreateDirectoryW LocalFree

user32

FindWindowA SetWindowLongPtrA GetDesktopWindow CallWindowProcA GetWindowRect SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture GetClientRect SetCursor MessageBoxA GetKeyState ScreenToClient GetCapture ClientToScreen GetForegroundWindow LoadCursorW SetCapture

comdlg32

GetOpenFileNameA

msvcp140

?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?bad@ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_unlock _Thrd_detach _Cnd_do_broadcast_at_thread_exit _Mtx_init_in_situ _Mtx_lock _Mtx_destroy_in_situ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

d3dx9_43

D3DXCreateFontW D3DXCreateLine D3DXCreateTextureFromFileInMemoryEx

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy memcmp memchr __C_specific_handler __std_exception_destroy __std_exception_copy _purecall __std_terminate strstr __current_exception __current_exception_context _CxxThrowException memset __std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

setvbuf fgetpos fwrite ungetc fgetc fsetpos fread _fseeki64 fclose _get_stream_buffer_pointers fflush ftell __stdio_common_vsprintf fputc fseek __stdio_common_vfprintf __stdio_common_vsscanf _wfopen

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-math-l1-1-0

sqrtf pow _hypotf sin sinf _dclass ceilf cos cosf floorf _dsign powf fmodf atan2f

api-ms-win-crt-convert-l1-1-0

strtod strtoll atof strtoull

api-ms-win-crt-runtime-l1-1-0

_cexit _register_onexit_function _invalid_parameter_noinfo_noreturn _crt_atexit _seh_filter_dll _initialize_onexit_table terminate _configure_narrow_argv _beginthreadex _initterm_e _initterm _execute_onexit_table _errno _initialize_narrow_environment

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

strcpy_s strcmp _stricmp strncpy