General

  • Target

    qtemu-1.0.5.exe

  • Size

    5.1MB

  • Sample

    240711-wbz3zsxcpn

  • MD5

    612517895c18fe7c0c9bc1b4b24d86bc

  • SHA1

    064318f1c199340fd08c5e314347f5a93460dc83

  • SHA256

    78e964883e5c4bf9e1e49eb1e2df92b3bc69a7a8bca1dd9fd828a8c7fc11c502

  • SHA512

    efc5af9d426e085cf1b504f4c0bc3360415387ba1a85d4c1c9bbfab824fdbc0f9a7af04f1b5d95acf9442ae12ac3f029fb2977d7ad0c226df05ba0d4fe02648f

  • SSDEEP

    98304:72KFnVM0ffH/0/0nAPfYsTbAwqaFT9+QjYwDcuy3hJJk/n0BNIGW:7bnVMM/0IWAsTbXqaHD6t02Ip

Score
7/10

Malware Config

Targets

    • Target

      qtemu-1.0.5.exe

    • Size

      5.1MB

    • MD5

      612517895c18fe7c0c9bc1b4b24d86bc

    • SHA1

      064318f1c199340fd08c5e314347f5a93460dc83

    • SHA256

      78e964883e5c4bf9e1e49eb1e2df92b3bc69a7a8bca1dd9fd828a8c7fc11c502

    • SHA512

      efc5af9d426e085cf1b504f4c0bc3360415387ba1a85d4c1c9bbfab824fdbc0f9a7af04f1b5d95acf9442ae12ac3f029fb2977d7ad0c226df05ba0d4fe02648f

    • SSDEEP

      98304:72KFnVM0ffH/0/0nAPfYsTbAwqaFT9+QjYwDcuy3hJJk/n0BNIGW:7bnVMM/0IWAsTbXqaHD6t02Ip

    Score
    7/10
    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Target

      qemu/keymaps/no

    • Size

      2KB

    • MD5

      01b3a19042cee7418ddf9d6a76d3e7a7

    • SHA1

      1c72f80109354053bab45971a0376b3961af3296

    • SHA256

      7ee3ef9129116d0c003f86d45c33de01db514042c5dff6f71a7ce19a55296ab1

    • SHA512

      d3015c9c07f3c16ee95d7e3b3764289b19da659a110d222293fe467c589e1268dc03311d6c3440c019a6953fa078917998c89c9a7659f9d39fa6e48694351194

    Score
    1/10
    • Target

      qemu/keymaps/pl

    • Size

      2KB

    • MD5

      afc7b8dfcc0a58352fb7cc0c741fdfe7

    • SHA1

      995e400dd2016b3841653f7a79b311a1d28ca8a3

    • SHA256

      e9152fb5f790a13928a07ee53d90f5591280671d8e45ed47aae9b06d14d20a24

    • SHA512

      c733eb8685c59ce348b29afc871edf26a46c19f789ec936d1b84a9f034d17d8be0b70619742300638a58d0b9ede15f96ba23bee1285d1993a5de3b88ad5212c2

    Score
    1/10
    • Target

      qemu/keymaps/pt

    • Size

      2KB

    • MD5

      992f51605dab5cfea7edebe70fe3e691

    • SHA1

      d7a11109f9240839205f9dd8a5acdb706d9e29ed

    • SHA256

      579712dde2f3d097ebceeaacf8ce915752e4ef3fca61f3e9cb8d83deb377fb29

    • SHA512

      f9dd061e7f516b10eb0e52de141f98d074734fe7b2859959ff623aa062e47fab955380f91f1a56905c3526c6dac72ab178448751b3563ef4de9807b3a52bdf96

    Score
    1/10
    • Target

      qemu/keymaps/pt-br

    • Size

      1KB

    • MD5

      b5f7190ba8b16d437447db719f2dc73f

    • SHA1

      db3edc45ec7b4e1b5033707804a06d840e232765

    • SHA256

      349df687bb2d80bb339979801153fa416c81515977f28d26f26a86c30993fb7e

    • SHA512

      6517df06998b5a7a9fd6c42f2a1af1ba33b2698f107529515cabe9d3e506308a43ce0c5c2baa7bb254d6690cee3ef8e200716c5eb8c24f60ed5e9bcf127d756b

    Score
    1/10
    • Target

      qemu/keymaps/ru

    • Size

      2KB

    • MD5

      d67dbf445ded048e9d231ca8e845fc13

    • SHA1

      932ed8c98abcc3682a457eb6ad9b1c99282bde17

    • SHA256

      b496758dc5207dbd6293068a1415d605c0d377e4f45ada79c8be48a3e1181f49

    • SHA512

      731722797fadf3c421fc438326ac6cb798bd5a25f005d0a49f48099752733134b03e631b16331277e8541ba9625f789b7833eaf382616510362be357ed441353

    Score
    1/10
    • Target

      qemu/keymaps/sl

    • Size

      2KB

    • MD5

      dc7d7dc1ecb55c119f61a5fd52b6de39

    • SHA1

      e4558a26f2827bd8653cc2274f2b6e8ef6f1488d

    • SHA256

      260e63359a991493a76589da8d76b143a7415b1f59f9782cba0381f4dfd26541

    • SHA512

      12b3719e91a5ad72c84e0af1154b322e8443b7a1a2576bbb88bc13674dc101097b01b1a3b70a4249dfbe77968aae2767f79476ddb04c8089f9750102692606d7

    Score
    1/10
    • Target

      qemu/keymaps/sv

    • Size

      1013B

    • MD5

      ed2f7b52f81bd5fedd923f0737b139f7

    • SHA1

      08d077c524b75eb2ace5b9fd7fb4bf289e61a634

    • SHA256

      0da4f485df9efa109fe130f614ef34422075af306a9b8d204e2fac61c4098fcf

    • SHA512

      44841395a775044dacfc272899508ba9fa4b87209fc4b625e0b52125ba0d24d95eba38ce7ade541a0e84c2db1fa6b00515db7509f2fff71f0a5d1df43f350ae4

    Score
    1/10
    • Target

      qemu/keymaps/th

    • Size

      3KB

    • MD5

      140fdef82ae4079d600136da3f8288df

    • SHA1

      ee9ee2b3988acf032af83716b7d835ac491a8042

    • SHA256

      296b24ecd6c3eeaad9d62423275ac4cb88ad04fa60e2fa1dece62018955c5916

    • SHA512

      2c3168f73f2501ce67f50e4b57cba3726f403bc9155bbc60d0db93f31f59a4c8b0416613c7e3cb6c166499cc575af6239e8ce29d4e5557987864e7bdc3405fe3

    Score
    1/10
    • Target

      qemu/keymaps/tr

    • Size

      2KB

    • MD5

      9d03bb64b58e924ed1baa22de63cbab7

    • SHA1

      2d976340cac8e3b9e37a972ba6f577a3879150c3

    • SHA256

      182134f513a05fab99cb15748b7622c579d880ca2bca2709d1ae41af825d0891

    • SHA512

      360e28b527a62a748b7a51e78ec5852314b5f9af404f43b6eb7d1ae29be65caf9e36163f3f8a7ab7f4109b990c20c6f7600aa007d03a32538556a90c6464b224

    Score
    1/10
    • Target

      qemu/libusb0.dll

    • Size

      41KB

    • MD5

      989f5b2fc89de3557307b703ce6a865d

    • SHA1

      4d44ea5b13c438fedf38053b29cc8522247a13a7

    • SHA256

      09a5f4f11a46f5b03d971a99fd885504cabb39604e68727fbfa0d3fd97efb55d

    • SHA512

      569a3b07cf22313bde03c66de2caec95fe8a100077d1f561faaa43b06db327bf0cb425cf0ce435c2135de1abc293c791eb144442ba462e4b33bd80372f31159b

    • SSDEEP

      768:NP4DHMAWcAqOW+9WjJVMdOoC3jNkwp68BM6sBly:NHAWPdWww/QTCBM1Bly

    Score
    1/10
    • Target

      qemu/linux_boot.bin

    • Size

      512B

    • MD5

      083168795fc3a90d48d8dcaf7a5eb3b4

    • SHA1

      2d6584b5e91e8f9f5e5115a01555f5085e41bd54

    • SHA256

      42f95b2f2bf136e531ad359613d8637f06a5d823164314675adaf50c658b7281

    • SHA512

      c34bf99f65c471be36ed8f76955899cca4e62150671cf547c8f5d6200f253d6f19f2496e95f54e74989e6b78515e97c032b722d551855010435dbc1d47291039

    Score
    3/10
    • Target

      qemu/pxe-ne2k_pci.bin

    • Size

      32KB

    • MD5

      015d146cb8e33266fd14dc0efd7db294

    • SHA1

      aed0b87126e3e6ff0c3f9be825e120c6e49ad8b1

    • SHA256

      38f7a5179e3bbdca5e3b63f468abd1bdcffb78e067cb23527aef31ad41165b70

    • SHA512

      287ed88a820b3f18f8a51da21670d2e443976c83573893871a552bbb46d193ccdb118866d4b5ea6f7039434cedc46626933093fff5ec69011d9ee7d8936154ac

    • SSDEEP

      384:O1VYIo/ofEavGKO8TK8USPPOIpnDmRDf4fEUkb0h9yPEAgT3xkYecnoNTpt:MVJo/AOeTyoPjpDo4fEFb+XTBkccpt

    Score
    3/10
    • Target

      qemu/pxe-pcnet.bin

    • Size

      32KB

    • MD5

      26e1f7ecfbed092ca293a3355b4fa896

    • SHA1

      b3ef326fbb5871eca7271d294e0949c1b1d506cb

    • SHA256

      a33db373d84e2475a1f77185a2268b17e562c18b1de046ea8bd9cd405a5eae93

    • SHA512

      cb196ed25f23df7282cdd8ce712d5d23a1ad96775d6966b85bcac79c2d61f1fd40886c38cbdb2937cfa019941cb137dabeae211787640a83f276a14e579d7d33

    • SSDEEP

      384:u1Vc+V+naJkFtOihyV1fvLzSifCzp/FfENl5hd/Ug2ljaSY1+lELafBQqV:sVv4MfnVC0d/Uggj0eELkF

    Score
    3/10
    • Target

      qemu/pxe-rtl8139.bin

    • Size

      32KB

    • MD5

      e416ea343aeb25fd4b18853a36b4c3ee

    • SHA1

      980f6d2f17134d0b74188f85430dca3e4a95223c

    • SHA256

      92c877a99e48286f04d586a2b270ca76c96b0a3b127be692827903d8e65531a5

    • SHA512

      795d800b56203f404a84633d1dd601c399e48df0d2b16bcc831602f26a0f2e0c46080ad8df0d38afceb72bba1c66b4e4476def36969505abdc464baab6dd00ea

    • SSDEEP

      384:f1VrhvfRF4lLfiYnvbFKJErHCelQVP6lcufXjZXn3tbBml9PWQh:dVdvf0WYv5KJEriLB6jXjJn34cc

    Score
    3/10
    • Target

      qemu/qemu-img.exe

    • Size

      213KB

    • MD5

      4ebd065631a91448005a39e653394af2

    • SHA1

      3feed567e8c088d398f129379abea729a090864f

    • SHA256

      8382f677a2ea0e2568146dcccae06f5678f4492c2dfc4a8cccdcf6997fa51876

    • SHA512

      aa251c34f3f97e01f05387e625426083d35b59c23ab8066f8ebf2026bdb70c2dcb4e69b1c142951dabf2904a3b26a6a05f367e4c2b17603f4880d014d55d45e1

    • SSDEEP

      6144:VFmF573JIva94GGdzA1/ZQwTBS4coEhlUi3:7O73JIva94GrxZvT4flUi3

    Score
    1/10
    • Target

      qemu/qemu-system-x86_64.exe

    • Size

      1.6MB

    • MD5

      87c15eb0d37138eb34e80c3a2282a8ca

    • SHA1

      d016c0bd89297333ce1c0dd25d7329749104fa45

    • SHA256

      158854f15ae71fe9cb09627779b36fe1abc1b5fc7081ab43a68ffba6f2d80b4d

    • SHA512

      a3ff4022f2d4e154e0e2b14cf7696894303f3c7e451f5da14fcf24bc1effa13c5ccf032c03ab903bad0b4d5801606fffc6b94aeeab4d49c8ce370c25e2f5ffe8

    • SSDEEP

      24576:NA5A6+WZt3EWAzIbOi6zD4Pk3Wo7gJRKG0XhoT8ZX9hQavo1/:+SWr3VAAOi6zsP2gJR7TKaa+

    Score
    7/10
    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      qemu/qemu.exe

    • Size

      1.3MB

    • MD5

      e74a97febad70498c1e739a11dff3ff5

    • SHA1

      ed11311f4e4d9963a485ff0f4244997a3ce51825

    • SHA256

      9b0224df2347e8199225f1da42d3a14ef8159ea2814c1397fe6cca660b0b4ae8

    • SHA512

      421f89aa0c864cf25d6338b18b4caa4bca1b646d423c58100c2f60ee9163df44bbfb1366c83e500b31bd695eda81cd05016905ee7f10b832282e3f00e14e0916

    • SSDEEP

      24576:7J+lxg6iXSYWfGZZU7ufx7PrFZoD0aD/YrqUgW3TwZH5CXpS0:lrXuf6ZU787PrMfUxTWS

    Score
    1/10
    • Target

      qemu/vgabios-cirrus.bin

    • Size

      34KB

    • MD5

      c9c90eb336f1ea1402a99c0e2993b1c3

    • SHA1

      8e2d42ed8e6dce55db921e652c7017341bd2864d

    • SHA256

      b1ac03094f4f0b3ca004329c59ea0df394353ba7a8d25bf6d3ef1f2ec921864a

    • SHA512

      35e7cac3119f75a92bb551bbee3c5f9240c0744ca6fc722819b13f26760f2524cf3f2bcdc7d46317df9eb1c2f63b9566489fcda393f57096f6e15cb4302f4e69

    • SSDEEP

      384:GyQfaJHokcnm45TDeL7nO4bsvc4MrQJlw55SQm0cjdKbAdI+8:GyQGHmOL7O4bdvQJlw7J4jd4

    Score
    3/10
    • Target

      qemu/vgabios.bin

    • Size

      37KB

    • MD5

      5773c09d18c8196ad41ffc26837010b8

    • SHA1

      b3424253385b04097daa0a63263ff87d1ea4f6e7

    • SHA256

      16254a8bbc187ca4922c47268f762aae27b111bd1c6aa16f8ea3cc63849eac9c

    • SHA512

      35abdd02e32bff4ae0779cb8388796a8543cd3d7b3add3794be56d0dc971744c4f9ce478062c643cba04fdcdfb3ce602bd448a34e1a3b25bc071931de818eaf9

    • SSDEEP

      384:RPfaJHokcnmFgmgmTnps8kP2MfX4FKwJVjD5SQqe76dKgyXdIN:RPGH8Rm1sbP261wJVjNJaP

    Score
    3/10
    • Target

      qtemu.exe

    • Size

      379KB

    • MD5

      e906af086fabd8de81365ea915661c4a

    • SHA1

      2b8ad0a4eb4e9497e302d942e86021d6384e3b99

    • SHA256

      477923a4b486b7b87c620e1fa27c49d41d3d9387c4444b54c365dd0dcced367c

    • SHA512

      ffc16dfe9b1813060678a9a0758f744ebd20ea453d6d8e8cb8fa8273fe320f484f4f6dcc19c5c0fb0c07563ef95a04a3ed0588f26cb5abb974536d1909543ef5

    • SSDEEP

      6144:RCPzdSDOXQvJvmaA0MV10LTZTHyj91QseWcKZc0/dQzlEErZQdEPAv28cO:RCPzduv6PeCotZQB

    Score
    1/10
    • Target

      qtemu.exe.manifest

    • Size

      543B

    • MD5

      050df78890dd1e2675b3a4a4dc8c25d7

    • SHA1

      3a9cc1e1f436176afc595416e5250ef35021f18d

    • SHA256

      ba6f132fed6ae2a44119bc3eac4752e5d92552de8b990b18dc16b24adcd2920c

    • SHA512

      19671c7b06cc51a256c5cd55eeb7d722ca59031ea3369154d95971f23ebe0560198b55a0af14155b7d5f521c2ce4dbe12457e82051fd6690d434c48802977809

    Score
    1/10
    • Target

      qtemu.ico

    • Size

      2KB

    • MD5

      e70c4b8241c1f757deb8d994f94f4f9f

    • SHA1

      6b70c49798cbd26f33df6ed4aa43394e459b6365

    • SHA256

      4e2c014d91cab48d66f7835b77faf44f6d423f530efb8df196ae1cc5732870e8

    • SHA512

      717b34e1552e28779d5a1ec32fd107daf00239b3036949539ca679895cbeac3a6632100ba5e92b350cbbb93d9ada09c3c5843a96e746105048d953243dcd92ab

    Score
    3/10
    • Target

      translations/qtemu_cz.qm

    • Size

      17KB

    • MD5

      41ac1c78eda7b10dc71cb034f5799f05

    • SHA1

      b0f4cb45f34094c4507c57d03226d042125fb722

    • SHA256

      3fb607bcbde82e650e388ea60cdb5f0fd8d4b2508efc87420eefdfdd1773d273

    • SHA512

      d8559e5616719d572a01fd62eacd8fdfbda52bb009fc6413156bbd4201045200d8010ee52ceb1108c98af89efc76c19404583e244d03475b891363fbf85cc11d

    • SSDEEP

      192:bclMS1dnRrx9HMB5850Ti+O4FvH/xdHMVYBbyXcKt1/0S3USV9RmWnHo+NmtVo9A:42yl7yjrHOXhthfj9MFAWGARv/B/

    Score
    3/10
    • Target

      translations/qtemu_de.qm

    • Size

      19KB

    • MD5

      0c5f3a02e8c9d341a10373dfb366ca1e

    • SHA1

      8e9fd4bb790e3b925b2059efbc0e12c1370839b7

    • SHA256

      92dd8c99f96529062122b9741de38545dc209f8499148c3c58cbd183897e8001

    • SHA512

      f2d64540a889c41e0be167d679adfc418f920e9e60616115e4e8bfb24ea83a129604981cfbfc50cf7aac265c097fdb2636ed55101878996b720905dc089a3770

    • SSDEEP

      384:0oOuBkcgHO/GNacvp8wX5tkGz1HyDCYC9U8k3wPNWIKiKup+jFG:eTcgHO/Gkcvp8wX0Gz1HyDCYAU8k3wPZ

    Score
    3/10
    • Target

      translations/qtemu_es.qm

    • Size

      18KB

    • MD5

      f7de4451ad7a88b465391ae514037b8a

    • SHA1

      0ac413555f869696ee1c64c32550bffbc15901d9

    • SHA256

      e337f8ba8311d1d27ff732b2a9dd660f83157a8b0ffbc284082a0e30ea7431f8

    • SHA512

      60aab1e32ab649fbc61ee979d019aab46afad33f073d70cd2d0ae8539889324fb2b16cbbadf3da1c49cccdc27eedb0181d9dd18d1535b0ab2a9a47f29566f1e8

    • SSDEEP

      192:PxrrjS8nx41w2FwSswHAdZrZHaBPHvrSbnbeTtrXuXX/OTipJlHcALryPfidbnwC:PQ84wY5G7CTtqGnAiYnw8JILsdxYg

    Score
    3/10
    • Target

      translations/qtemu_fr.qm

    • Size

      19KB

    • MD5

      9303907f6f9d9f9f49f48c43117a7cf0

    • SHA1

      e23f736da6ade0c3164f27363074ce5daaa6997f

    • SHA256

      fbfee6a7c478924398cd84aaeba9fb39752fcfae43aba71b32618f3426bfab20

    • SHA512

      954bfbc849028df0652af3fee4985e3adea3ca6689cd8937eee0d4edc5f4502f5c0c837ca31495c4882b44a665ef807c6fb2b2ecfdcfc745692edcc8b7dcbaca

    • SSDEEP

      384:KEauB0R2Xo1adtL3WLoeJvR+YmCkg3YMdbB:xraRZ1af3WrUYIMpB

    Score
    3/10
    • Target

      translations/qtemu_it.qm

    • Size

      19KB

    • MD5

      9120fd02e689e9a3be4e8dc3d0865031

    • SHA1

      dd67d7add60c021ddec20002b2be0a25ce872503

    • SHA256

      a9879d0449d083c88a7d142fd78d12d4cefd22e4da02431255890021d90dd6eb

    • SHA512

      81c6f103e6d1a43ec48c21949b759044219ffadd984a30eaab6511680d55d0dba4ccc4d4e78c29eb5bdc3127bf0826d2bb9de0fe86193d9f3af0ee53498f27b4

    • SSDEEP

      192:bWXbTtsBjj2PkG5+2NRvogCXJzHwCKvH9dzQKbjYtCQ4mNezGaHGQ8VLqUXoY1id:ZlGeZKMKPYtC8B18mFYaw7

    Score
    3/10
    • Target

      translations/qtemu_pl.qm

    • Size

      18KB

    • MD5

      623bde3fbbd9f9604cb6411144265b06

    • SHA1

      4b17676ef697e9c2209285632e516317024ca9c2

    • SHA256

      d954ff801ba363ddb32eacafeddbe12e1419318da017a54fcb5121a77fefe0de

    • SHA512

      817e569d62860ed76c99e04b59c88e5bab8882c28bf6c7a91acddc35cb3eeb09de7fae01e2bb13e176c60b68d5db4b68b2392119bf1d66135baa6855aa9ce9a4

    • SSDEEP

      384:lVyjWNP7DPJv350S7t4XXNtM2NmalMBetVHQj3:lVfRJ0SWNmnalMoFs3

    Score
    3/10
    • Target

      translations/qtemu_pt-BR.qm

    • Size

      19KB

    • MD5

      41fa166bf4ccc3714465d085e067b6e7

    • SHA1

      ec3e036d7e9842ae382bb4a626ad9afd62302241

    • SHA256

      5c8e74b7831accdff247fd006ba3c4944742bba1bdb63e92b1be2d39c64ab0cb

    • SHA512

      1eddae8b7737e0ac55a967d213b5b144d99e6cd56ea1bad0609faf2858fec8d14073bb58ba537e5f39dc74e4ff88f04e61e01ca2f88c62c08c0314a5b9515925

    • SSDEEP

      192:rRTVJVKErFMwXCYGQ2nSJSbt66rZHgfyHaF3rSbbibpDvtXwsGZqsQCKHwwPwmiw:rRTVBnJ9TFWSFztF46lxZbJiA

    Score
    3/10
    • Target

      translations/qtemu_ru.qm

    • Size

      18KB

    • MD5

      2bc897fe2b016b5e321ed1a1f346deb6

    • SHA1

      3387aea799eed2da7bbc8805c61d0f178aaf0c66

    • SHA256

      f9e2e58059cffe8912b0504eb62ece8e57048a6f000251f08577087c29940490

    • SHA512

      33fe454489388b183cd6650a6d67ee84b0b7696d2c77a0e109fd59c6a4c385b11e6c60b8248086dba67cac529fab5d8ba83852cbba1130cad1f903e90c2d2eb3

    • SSDEEP

      384:aebU7D5DVwaFjSptrXTZIe8DozELJ0lfl:xbU5DVwaFjSLXTZx8DozELJ0tl

    Score
    3/10
    • Target

      translations/qtemu_tr.qm

    • Size

      17KB

    • MD5

      68e7c3b893bd18955fb501c045dc6221

    • SHA1

      8da4ebd5c60c2c878f8560838324f7d0b84abc6f

    • SHA256

      add34d93c50644264ef15949d04fef3d52c18c3a5f63e9beea94afe1507f664e

    • SHA512

      6e111caa76bf5a02927a904ca6359a4a68e2eb56229f7655fb34f96445284af64e44f61167a58db70fb8537e9acfe0f48ef0bde278fb4428bcf396ed90565d5e

    • SSDEEP

      384:5/KNqTdRGd9Z46ewM4iXIz/1RgtGRibNgcFR+IQI7XiOpRBexrwGYHj1Fr:5/h/6E7wCY/1H7O8Ip7XieW6Gqr

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks