Overview

overview

10

Static

static

10

qemu-w64-s...29.exe

windows10-2004-x64

7

qemu-w64-s...29.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    qemu-w64-setup-20260729.exe
  • Size 197.0MB
  • Sample260802-wya3davwd1
  • SHA256 f88141ccb5597ceb7bed58ffb6cd173d3fc14233772bc6edff6583c7b4bb816c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryransomware

Malware Config

Extracted

Ransom Note
  • QEMU Contents: About QEMU System Emulation User Mode Emulation Tools System Emulation Management and Interoperability Barrier client protocol Dirty Bitmaps and Incremental Backup D-Bus D-Bus VMState D-Bus display D-Bus VNC Live Block Device Operations QEMU NBD protocol support Parallels Expandable Image File Format Parallels Disk Format Qcow2 Image File Format QED Image File Format Specification Persistent reservation helper protocol QEMU Machine Protocol Specification QEMU Guest Agent QEMU Guest Agent Protocol Reference QEMU QMP Reference Manual QEMU Storage Daemon QMP Reference Manual Introduction Common data types IoOperationType OnOffAuto OnOffSplit StrOrNull OffAutoPCIBAR PCIELinkSpeed PCIELinkWidth HostMemPolicy NetFilterDirection GrabToggleKeys HumanReadableText EndianMode Socket data types NetworkAddressFamily InetSocketAddressBase InetSocketAddress UnixSocketAddress VsockSocketAddress FdSocketAddress InetSocketAddressWrapper UnixSocketAddressWrapper VsockSocketAddressWrapper FdSocketAddressWrapper SocketAddressLegacy SocketAddressType SocketAddress Cryptography QCryptoTLSCredsEndpoint QCryptoSecretFormat QCryptoHashAlgo QCryptoCipherAlgo QCryptoCipherMode QCryptoIVGenAlgo QCryptoBlockFormat QCryptoBlockOptionsBase QCryptoBlockOptionsQCow QCryptoBlockOptionsLUKS QCryptoBlockCreateOptionsLUKS QCryptoBlockOpenOptions QCryptoBlockCreateOptions QCryptoBlockInfoBase QCryptoBlockInfoLUKSSlot QCryptoBlockInfoLUKS QCryptoBlockInfo QCryptoBlockLUKSKeyslotState QCryptoBlockAmendOptionsLUKS QCryptoBlockAmendOptions SecretCommonProperties SecretProperties SecretKeyringProperties TlsCredsProperties TlsCredsAnonProperties TlsCredsPskProperties TlsCredsX509Properties QCryptoAkCipherAlgo QCryptoAkCipherKeyType QCryptoRSAPaddingAlgo QCryptoAkCipherOptionsRSA QCryptoAkCipherOptions Background jobs JobType JobStatus JobVerb JOB_STATUS_CHANGE job-pause job-resume job-cancel job-complete job-dismiss job-finalize JobInfo query-jobs Block devices Block core (VM unrelated) Block device exports Character devices ChardevInfo query-chardev ChardevBackendInfo query-chardev-backends DataFormat ringbuf-write ringbuf-read ChardevCommon ChardevFile ChardevHostdev ChardevSocket ChardevUdp ChardevMux ChardevHub ChardevStdio ChardevSpiceChannel ChardevSpicePort ChardevVCEncoding ChardevDBus ChardevVC ChardevRingbuf ChardevQemuVDAgent ChardevPty ChardevBackendKind ChardevFileWrapper ChardevHostdevWrapper ChardevSocketWrapper ChardevUdpWrapper ChardevCommonWrapper ChardevMuxWrapper ChardevHubWrapper ChardevStdioWrapper ChardevSpiceChannelWrapper ChardevSpicePortWrapper ChardevQemuVDAgentWrapper ChardevDBusWrapper ChardevVCWrapper ChardevRingbufWrapper ChardevPtyWrapper ChardevBackend ChardevReturn chardev-add chardev-change chardev-remove chardev-send-break VSERPORT_CHANGE User authorization QAuthZListPolicy QAuthZListFormat QAuthZListRule AuthZListProperties AuthZListFileProperties AuthZPAMProperties AuthZSimpleProperties Transactions Abort ActionCompletionMode TransactionActionKind AbortWrapper BlockDirtyBitmapAddWrapper BlockDirtyBitmapWrapper BlockDirtyBitmapMergeWrapper BlockdevBackupWrapper BlockdevSnapshotWrapper BlockdevSnapshotInternalWrapper BlockdevSnapshotSyncWrapper DriveBackupWrapper TransactionAction TransactionProperties transaction QMP monitor control qmp_capabilities QMPCapability VersionTriple VersionInfo query-version CommandInfo query-commands quit MonitorMode MonitorOptions QMP introspection query-qmp-schema SchemaMetaType SchemaInfo SchemaInfoBuiltin JSONType SchemaInfoEnum SchemaInfoEnumMember SchemaInfoArray SchemaInfoObject SchemaInfoObjectMember SchemaInfoObjectVariant SchemaInfoAlternate SchemaInfoAlternateMember SchemaInfoCommand SchemaInfoEvent QEMU Object Model (QOM) ObjectPropertyInfo ObjectPropertyValue ObjectPropertiesValues qom-list qom-get qom-list-get qom-set ObjectTypeInfo qom-list-types qom-list-properties CanHostSocketcanProperties ColoCompareProperties CryptodevBackendProperties CryptodevVhostUserProperties DBusVMStateProperties NetfilterInsert NetfilterProperties FilterBufferProperties FilterDumpProperties FilterMirrorProperties FilterRedirectorProperties FilterRewriterProperties InputBarrierProperties InputLinuxProperties EventLoopBaseProperties IothreadProperties MainLoopProperties MemoryBackendProperties MemoryBackendFileProperties MemoryBackendMemfdProperties MemoryBackendShmProperties MemoryBackendEpcProperties PrManagerHelperProperties QtestProperties RemoteObjectProperties VfioUserServerProperties IOMMUFDProperties AcpiGenericInitiatorProperties AcpiGenericPortProperties RngProperties RngEgdProperties RngRandomProperties IgvmCfgProperties SevCommonProperties SevGuestProperties SevSnpGuestProperties TdxGuestProperties ThreadContextProperties MonitorProperties MonitorHMPProperties MonitorQMPCloseAction MonitorQMPProperties ObjectType ObjectOptions object-add object-del vfio-user Protocol Specification Vhost-user Protocol Vhost-user-gpu Protocol Vhost-vdpa Protocol Virtio balloon memory statistics VNC LED state Pseudo-encoding System Emulation Guest Hardware Specifications Developer Information Glossary QEMU System Emulation Management and Interoperability QEMU Storage Daemon QMP Reference Manual View page source QEMU Storage Daemon QMP Reference Manual Introduction Common data types Socket data types Cryptography Background jobs Block devices Block core (VM unrelated) Block device exports Character devices User authorization Transactions QMP monitor control QMP introspection QEMU Object Model (QOM) Introduction This manual describes the commands and events supported by the QEMU storage daemon QMP. For locating a particular item, please see the QSD Index . The following notation is used in examples: Example: -> ... text sent by client (commands) ... <- ... text sent by server (command responses and events) ... Example text is formatted for readability. However, in real protocol usage, its commonly emitted as a single line. Please refer to the QEMU Machine Protocol Specification for the general format of commands, responses, and events. Common data types Enum IoOperationType (Since: 2.1)  An enumeration of the I/O operation types : read – read operation write – write operation Enum OnOffAuto (Since: 2.2)  An enumeration of three options: on, off, and auto : auto – QEMU selects the value between on and off on – Enabled off – Disabled Enum OnOffSplit (Since: 2.6)  An enumeration of three values: on, off, and split : on – Enabled off – Disabled split – Mixed Alternate StrOrNull (Since: 2.10)  This is a string value or the explicit lack of a string (null pointer in C). Intended for cases when ‘optional absent’ already has a different meaning. : s ( string ) – the string value n ( null ) – no string value Enum OffAutoPCIBAR (Since: 2.12)  An enumeration of options for specifying a PCI BAR : off – The specified feature is disabled auto – The PCI BAR for the feature is automatically selected bar0 – PCI BAR0 is used for the feature bar1 – PCI BAR1 is used for the feature bar2 – PCI BAR2 is used for the feature bar3 – PCI BAR3 is used for the feature bar4 – PCI BAR4 is used for the feature bar5 – PCI BAR5 is used for the feature Enum PCIELinkSpeed (Since: 4.0)  An enumeration of PCIe link speeds in units of GT/s : 2_5 – 2.5GT/s 5 – 5.0GT/s 8 – 8.0GT/s 16 – 16.0GT/s 32 – 32.0GT/s (since 9.0) 64 – 64.0GT/s (since 9.0) Enum PCIELinkWidth (Since: 4.0)  An enumeration of PCIe link width : 1 – x1 2 – x2 4 – x4 8 – x8 12 – x12 16 – x16 32 – x32 Enum HostMemPolicy (Since: 2.1)  Host memory policy types : default – restore default policy, remove any nondefault policy preferred – set the preferred host nodes for allocation bind – a strict policy that restricts memory allocation to the host nodes specified interleave – memory allocations are interleaved across the set of host nodes specified Enum NetFilterDirection (Since: 2.5)  Indicates whether a netfilter is attached to a netdev’s transmit queue or receive queue or both. : all – the filter is attached both to the receive and the transmit queue of the netdev (default). rx – the filter is attached to the receive queue of the netdev, where it will receive packets sent to the netdev. tx – the filter is attached to the transmit queue of the netdev, where it will receive packets sent by the netdev. Enum GrabToggleKeys (Since: 4.0)  Key combinations to toggle input-linux between host and guest. : ctrl-ctrl – left and right control key alt-alt – left and right alt key shift-shift – left and right shift key meta-meta – left and right meta key scrolllock – scroll lock key ctrl-scrolllock – either control key and scroll lock key Object HumanReadableText (Since: 6.2)  : human-readable-text ( string ) – Formatted output intended for humans. Enum EndianMode (Since: 10.0)  : unspecified – Endianness not specified little – Little endianness big – Big endianness Socket data types Enum NetworkAddressFamily (Since: 2.1)  The network address family : ipv4 – IPV4 family ipv6 – IPV6 family unix – unix socket vsock – vsock family (since 2.8) unknown – otherwise Object InetSocketAddressBase  : host ( string ) – host part of the address port ( string ) – port part of the address Object InetSocketAddress (Since: 1.3)  Captures a socket address or address range in the Internet namespace. : numeric ( boolean , optional ) – true if the host/port are guaranteed to be numeric, false if name resolution should be attempted. Defaults to false. (Since 2.9) to ( int , optional ) – If present, this is range of possible addresses, with port between port and to . ipv4 ( boolean , optional ) – whether to accept IPv4 addresses, default try both IPv4 and IPv6 ipv6 ( boolean , optional ) – whether to accept IPv6 addresses, default try both IPv4 and IPv6 keep-alive ( boolean , optional ) – enable keep-alive when connecting to/listening on this socket. (Since 4.2, not supported for listening sockets until 10.1) keep-alive-count ( int , optional ) – number of keep-alive packets sent before the connection is closed. Only supported for TCP sockets on systems where TCP_KEEPCNT socket option is defined (this includes Linux, Windows, macOS, FreeBSD, but not OpenBSD). When set to 0, system setting is used. (Since 10.1) keep-alive-idle ( int , optional ) – time in seconds the connection needs to be idle before sending a keepalive packet. Only supported for TCP sockets on systems where TCP_KEEPIDLE socket option is defined (this includes Linux, Windows, macOS, FreeBSD, but not OpenBSD). When set to 0, system setting is used. (Since 10.1) keep-alive-interval ( int , optional ) – time in seconds between keep-alive packets. Only supported for TCP sockets on systems where TCP_KEEPINTVL is defined (this includes Linux, Windows, macOS, FreeBSD, but not OpenBSD). When set to 0, system setting is used. (Since 10.1) mptcp ( boolean , optional ) – enable multi-path TCP. (Since 6.1) The members of InetSocketAddressBase . Object UnixSocketAddress (Since: 1.3)  Captures a socket address in the local (“Unix socket”) namespace. : path ( string ) – filesystem path to use abstract ( boolean , optional ) – if true, this is a Linux abstract socket address. path will be prefixed by a null byte, and optionally padded with null bytes. Defaults to false. (Since 5.1) tight ( boolean , optional ) – if false, pad an abstract socket address with enough null bytes to make it fill struct sockaddr_un member sun_path. Defaults to true. (Since 5.1) Object VsockSocketAddress (Since: 2.8)  Captures a socket address in the vsock namespace. : cid ( string ) – unique host identifier port ( string ) – port Note String types are used to allow for possible future hostname or service resolution support. Object FdSocketAddress (Since: 1.2)  A file descriptor name or number. : str ( string ) – decimal is for file descriptor number, otherwise it’s a file descriptor name. Named file descriptors are permitted in monitor commands, in combination with the getfd command. Decimal file descriptors are permitted at startup or other contexts where no monitor context is active. Object InetSocketAddressWrapper (Since: 1.3)  : data ( InetSocketAddress ) – internet domain socket address Object UnixSocketAddressWrapper (Since: 1.3)  : data ( UnixSocketAddress ) – UNIX domain socket address Object VsockSocketAddressWrapper (Since: 2.8)  : data ( VsockSocketAddress ) – VSOCK domain socket address Object FdSocketAddressWrapper (Since: 1.3)  : data ( FdSocketAddress ) – file descriptor name or number Object SocketAddressLegacy (Since: 1.3)  Captures the address of a socket, which could also be a named file descriptor : type ( SocketAddressType ) – Transport type When type is inet : The members of InetSocketAddressWrapper . When type is unix : The members of UnixSocketAddressWrapper . When type is vsock : The members of VsockSocketAddressWrapper . When type is fd : The members of FdSocketAddressWrapper . Enum SocketAddressType (Since: 2.9)  Available SocketAddress types : inet – Internet address unix – Unix domain socket vsock – VMCI address fd – Socket file descriptor Object SocketAddress (Since: 2.9)  Captures the address of a socket, which could also be a socket file descriptor : type ( SocketAddressType ) – Transport type When type is inet : The members of InetSocketAddress . When type is unix : The members of UnixSocketAddress . When type is vsock : The members of VsockSocketAddress . When type is fd : The members of FdSocketAddress . Cryptography Enum QCryptoTLSCredsEndpoint (Since: 2.5)  The type of network endpoint that will be using the credentials. Most types of credential require different setup / structures depending on whether they will be used in a server versus a client. : client – the network endpoint is acting as the client server – the network endpoint is acting as the server Enum QCryptoSecretFormat (Since: 2.6)  The data format that the secret is provided in : raw – raw bytes. When encoded in JSON only valid UTF-8 sequences can be used base64 – arbitrary base64 encoded binary data Enum QCryptoHashAlgo (Since: 2.6)  The supported algorithms for computing content digests : md5 – MD5. Should not be used in any new code, legacy compat only sha1 – SHA-1. Should not be used in any new code, legacy compat only sha224 – SHA-224. (since 2.7) sha256 – SHA-256. Current recommended strong hash. sha384 – SHA-384. (since 2.7) sha512 – SHA-512. (since 2.7) ripemd160 – RIPEMD-160. (since 2.7) sm3 – SM3. (since 9.2.0) Enum QCryptoCipherAlgo (Since: 2.6)  The supported algorithms for content encryption ciphers : aes-128 – AES with 128 bit / 16 byte keys aes-192 – AES with 192 bit / 24 byte keys aes-256 – AES with 256 bit / 32 byte keys des – DES with 56 bit / 8 byte keys. Do not use except in VNC. (since 6.1) 3des – 3DES(EDE) with 192 bit / 24 byte keys (since 2.9) cast5-128 – Cast5 with 128 bit / 16 byte keys serpent-128 – Serpent with 128 bit / 16 byte keys serpent-192 – Serpent with 192 bit / 24 byte keys serpent-256 – Serpent with 256 bit / 32 byte keys twofish-128 – Twofish with 128 bit / 16 byte keys twofish-192 – Twofish with 192 bit / 24 byte keys twofish-256 – Twofish with 256 bit / 32 byte keys sm4 – SM4 with 128 bit / 16 byte keys (since 9.0) Enum QCryptoCipherMode (Since: 2.6)  The supported modes for content encryption ciphers : ecb – Electronic Code Book cbc – Cipher Block Chaining xts – XEX with tweaked code book and ciphertext stealing ctr – Counter (Since 2.8) Enum QCryptoIVGenAlgo (Since: 2.6)  The supported algorithms for generating initialization vectors for full disk encryption. The ‘plain’ generator should not be used for disks with sector numbers larger than 2^32, except where compatibility with pre-existing Linux dm-crypt volumes is required. : plain – 64-bit sector number truncated to 32-bits plain64 – 64-bit sector number essiv – 64-bit sector number encrypted with a hash of the encryption key Enum QCryptoBlockFormat (Since: 2.6)  The supported full disk encryption formats : qcow – QCow/QCow2 built-in AES-CBC encryption. Use only for liberating data from old i
URLs

  • https://gnutls.org/manual/html_node/Priority-Strings.html

Targets

    • Target
      qemu-w64-setup-20260729.exe
    • Size 197.0MB
    • SHA256 f88141ccb5597ceb7bed58ffb6cd173d3fc14233772bc6edff6583c7b4bb816c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks