ZqousPerm[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ZqousPerm.exe
Size 11.5MB
Sample260825-sdctpahf33
SHA256 3120182f03d3eb284d8df06a289211da3e03e2649c5c31c1e3489ec8f29d034a
MD5 ce423491e631ee64b4d7ff5da95c80af
SHA1 7f7fbb7d31a951a9abc4b670d4314c335ff7954b
SHA512 ea283cf017fd91732a6bf824215d4b3d66cc8e6b83efd73300f2c0fb910d5a1d7b3b26153e345dda3efa8af03ee07a3c2a8098bb3de75a26a5aa4564d5f36be0
SSDEEP 196608:0v0XvckyzTAhV0I3UMhD0hpMXfpVAmLaRuBsKLRL:035u+I3qspVAmsu2K
TLSH
T1CBC68D16EBA649E5D0B3923489669667F3B2BC500FB4C7DF3298160A1F737E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ZqousPerm.exe

File Explorer

ZqousPerm.exe

.exe 11.5MB

ZqousPerm.exe

IMPHASH b400bb09124abdf5e6f9fd931f81abdd
SHA256 3120182f03d3eb284d8df06a289211da3e03e2649c5c31c1e3489ec8f29d034a
MD5 ce423491e631ee64b4d7ff5da95c80af
SHA1 7f7fbb7d31a951a9abc4b670d4314c335ff7954b
SHA512 ea283cf017fd91732a6bf824215d4b3d66cc8e6b83efd73300f2c0fb910d5a1d7b3b26153e345dda3efa8af03ee07a3c2a8098bb3de75a26a5aa4564d5f36be0
SSDEEP 196608:0v0XvckyzTAhV0I3UMhD0hpMXfpVAmLaRuBsKLRL:035u+I3qspVAmsu2K
TLSH
T1CBC68D16EBA649E5D0B3923489669667F3B2BC500FB4C7DF3298160A1F737E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

535656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Zqous\Downloads\3LA2 SPOOFER SOURCE LEAK\3LA2 SPOOFER SOURCE LEAK\ZqousSpoofer\bin\Release\x64\ZqousPerm.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

LocalFree VirtualProtect CreateToolhelp32Snapshot Process32NextW GetCurrentThread Process32FirstW GetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent CreateProcessA GetFileAttributesExW FreeLibrary RemoveDirectoryA QueryPerformanceFrequency WideCharToMultiByte FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx MultiByteToWideChar AreFileApisANSI GetLastError GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter QueryPerformanceCounter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead LoadLibraryA GetModuleHandleA GlobalUnlock TerminateProcess GlobalLock GlobalFree GlobalAlloc DeleteFileA WaitForSingleObject GetLogicalDrives GetTickCount GetConsoleWindow GetModuleHandleW GetProcessHeap GetCurrentProcessId ExitProcess GetProcAddress HeapAlloc CreateThread CloseHandle Sleep GetCurrentThreadId GetCurrentProcess HeapFree FormatMessageA CreateDirectoryA

user32

DefWindowProcW GetWindowLongW MoveWindow GetClipboardData GetWindowRect DestroyWindow MessageBoxW CreateWindowExW SystemParametersInfoW GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW MessageBoxA SetLayeredWindowAttributes EmptyClipboard TranslateMessage CloseClipboard LoadIconW LoadCursorW PostQuitMessage UpdateWindow SetClipboardData OpenClipboard

advapi32

GetUserNameA FreeSid CheckTokenMembership RegOpenKeyExW RegDeleteTreeA RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegDeleteValueA RegEnumKeyExA AllocateAndInitializeSid

shell32

ShellExecuteA

ole32

CoInitialize CoUninitialize CoCreateInstance

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Id_cnt@id@locale@std@@0HA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??7ios_base@std@@QEBA_NXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

bcrypt

BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_copy _CxxThrowException __current_exception_context __current_exception memset memcpy memchr memcmp wcsstr strstr __std_terminate __C_specific_handler __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate exit _register_thread_local_exe_atexit_callback _c_exit _errno abort __p___argv _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type __p___argc _get_initial_narrow_environment _initterm _initterm_e _exit _invoke_watson

api-ms-win-crt-convert-l1-1-0

strtol strtod

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _popen fgets _wfopen _pclose __p__commode fseek __acrt_iob_func __stdio_common_vfprintf ftell __stdio_common_vsprintf_s __stdio_common_vsprintf fputc fflush _get_stream_buffer_pointers _set_fmode _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc fclose

api-ms-win-crt-filesystem-l1-1-0

remove _unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

isalnum isupper islower _wcsicmp strncmp tolower strncpy isdigit strcmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr sinf cosf sqrtf ceilf fmodf acosf powf