qqpass

Resubmissions

28/03/2025, 07:23

250328-h8bj1as1fv 10

28/03/2025, 07:16

250328-h33fjaszg1 10

Sharing

Copy URL

Twitter E-mail

General

Target

cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48
Size

75KB
Sample

250328-h8bj1as1fv
MD5

35aa48c51f67634ab9a05028ddacd91a
SHA1

41eda72d9456025eb0f881daac43f4b920fda1bd
SHA256

cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48
SHA512

5e3433d76ae896da6a91b66a49d15026620261eaab93acf498a0ea913eb5461bf44d7afae81dcebc878e04810da86fd3dea90d82eebbebfa75d3df7e1f1d3d4a
SSDEEP

1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOWWJ:GhfxHNIreQm+HidWJ

Score

10^/10

Malware Config

Extracted

Family

qqpass

http://www.zigui.org/article.php?id=103822

Attributes

url
http://www.mxm9191.com/myrunner_up.exe
user_agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Targets

- Target
  
  cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48
- Size
  
  75KB
- MD5
  
  35aa48c51f67634ab9a05028ddacd91a
- SHA1
  
  41eda72d9456025eb0f881daac43f4b920fda1bd
- SHA256
  
  cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48
- SHA512
  
  5e3433d76ae896da6a91b66a49d15026620261eaab93acf498a0ea913eb5461bf44d7afae81dcebc878e04810da86fd3dea90d82eebbebfa75d3df7e1f1d3d4a
- SSDEEP
  
  1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOWWJ:GhfxHNIreQm+HidWJ
Score

10^/10

qqpass discovery persistence trojan
- QQpass
  QQpass is a trojan written in C++..
  trojan qqpass
- Qqpass family
  qqpass
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Drops file in System32 directory
behavioral1 behavioral10 behavioral11 behavioral12 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Qqpass family

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12