qqpass | 2026-09-07_b1d7d6d876b6db8e44966eb10fb05d4d_elex_glassworm_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_b1d7d6d876b6db8e44966eb10fb05d4d_elex_glassworm_wannacry
Size 93KB
Sample260908-jzh36afq21
SHA256 38dd3cf3b2a57565fbb6a87a44e2c3b9fc73b78a5ba3a333fd7f58a3a66eb194
MD5 b1d7d6d876b6db8e44966eb10fb05d4d
SHA1 5b11e31f92ab9a8b8329de395f42d64348c6fa3b
SHA512 ff949344c8f6dd86a4b006d2edfb7ec648b7107491b739125cf47a1a2d82ff9d508af27b0a8bfbc52280f71cf35b7b5a2bd8252486736a113a129b5e6fb98742
SSDEEP 768:JgO5xRYi+SQvvG5bnl/NqNwsKVDsBYDO1kzaXKynF0vP:eshQvoLqNwDDhp+eP
TLSH
T1A9934A9F74E480FDE91421B414AB17B0817BAA8413BA67CB3BE1CD79843B12B573C287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan qqpass

Malware Config

Extracted

Family

qqpass

http://www.zigui.org/article.php?id=103822

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Signatures

Family: QQpass
QQpass is a trojan written in C++..
trojan qqpass

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_b1d7d6d876b6db8e44966eb10fb05d4d_elex_glassworm_wannacry

File Explorer

2026-09-07_b1d7d6d876b6db8e44966eb10fb05d4d_elex_glassworm_wannacry

.exe 93KB

2026-09-07_b1d7d6d876b6db8e44966eb10fb05d4d_elex_glassworm_wannacry

IMPHASH f24e64014af9015dc25262e5076fe61f
SHA256 38dd3cf3b2a57565fbb6a87a44e2c3b9fc73b78a5ba3a333fd7f58a3a66eb194
MD5 b1d7d6d876b6db8e44966eb10fb05d4d
SHA1 5b11e31f92ab9a8b8329de395f42d64348c6fa3b
SHA512 ff949344c8f6dd86a4b006d2edfb7ec648b7107491b739125cf47a1a2d82ff9d508af27b0a8bfbc52280f71cf35b7b5a2bd8252486736a113a129b5e6fb98742
SSDEEP 768:JgO5xRYi+SQvvG5bnl/NqNwsKVDsBYDO1kzaXKynF0vP:eshQvoLqNwDDhp+eP
TLSH
T1A9934A9F74E480FDE91421B414AB17B0817BAA8413BA67CB3BE1CD79843B12B573C287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4627 ord4425 ord3597 ord1146 ord1168 ord6376 ord4234 ord1768 ord5953 ord6199 ord6197 ord6377 ord4710 ord2379 ord6215 ord823 ord2055 ord2648 ord4441 ord4837 ord3798 ord5280 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1775 ord4078 ord6052 ord4998 ord4376 ord5265 ord2621 ord5943 ord2514 ord641 ord815 ord825 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord4673 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord324 ord1576

msvcrt

_except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit isdigit rename gmtime fgets sscanf fseek fread ftell strrchr fopen _setmbcp _strlwr _strupr _stricmp _strnicmp __CxxFrameHandler sprintf time atoi mktime strchr strstr srand rand strncpy strncmp memmove fclose fwrite _controlfp

kernel32

DeleteFileA SetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime GetTickCount CreateEventA GetLastError CloseHandle GetFileTime OpenFile ReadProcessMemory CreateDirectoryA GetModuleFileNameA WinExec SetFileTime SetFileAttributesA GetSystemDirectoryA GetWindowsDirectoryA GetCommandLineA GetTempPathA GetModuleHandleA GetStartupInfoA GetTempFileNameA Sleep lstrlenA GetVersionExA FreeLibrary TerminateProcess GetCurrentProcessId OpenProcess GetProcAddress LoadLibraryA FileTimeToSystemTime GetFileAttributesA

user32

FindWindowA FindWindowExA ShowWindow SetWindowPos GetClassNameA PostMessageA RegisterWindowMessageA IsWindowVisible GetForegroundWindow IsWindow GetDesktopWindow GetWindow GetParent SendMessageTimeoutA IsWindowEnabled MessageBoxA LoadIconA SetTimer SendMessageA GetKeyState EnableWindow GetWindowThreadProcessId GetDlgCtrlID

advapi32

RegSetValueExA RegDeleteKeyA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA

shell32

ShellExecuteA

ws2_32

gethostbyname recv send connect inet_addr htons closesocket socket setsockopt WSACleanup WSAStartup htonl

wininet

HttpSendRequestA DeleteUrlCacheEntry InternetReadFile HttpQueryInfoA InternetTimeToSystemTime HttpAddRequestHeadersA HttpOpenRequestA InternetOpenA InternetCloseHandle InternetConnectA