General
- Target TAKEOFF2.4.3-installer.exe
- Size 272.4MB
- Sample261002-wdqbkatakd
- SHA256 008b740af77e863f6a8caf955f141b7e5e495a11300035c51782066148179c03
Malware Config
Targets
-
- Target TAKEOFF2.4.3-installer.exe
- Size 272.4MB
- SHA256 008b740af77e863f6a8caf955f141b7e5e495a11300035c51782066148179c03
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QtGraphicalEffects/DirectionalBlur.qml
- Size 9KB
- SHA256 7bf44aeb3654480e2d1c23ca76e53ff5958574766dd95d3cd1f3a1e84510146c
Score3/10 -
- Target QtGraphicalEffects/ZoomBlur.qml
- Size 10KB
- SHA256 50ec0d53e7bcedb1af9b48caecb2df007f10ccd036e690b73e9578dce8ca5241
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QtGraphicalEffects/private/FastGlow.qml
- Size 8KB
- SHA256 82d6866cd116d6a13bd447f74b8b1b69203ac20e0f6f82c414b95c2319dbc0bd
Score3/10 -
- Target QtGraphicalEffects/private/FastInnerShadow.qml
- Size 8KB
- SHA256 676361ae072fa9dfef37dc9c0d5ec5d5d5c7a55a6b89cc089441bb8d3ebe725a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QtGraphicalEffects/private/GaussianDirectionalBlur.qml
- Size 11KB
- SHA256 da6f8f57eb015b5d4165bc3c297e8ad1fa3ffb38bafe5ac50ffa807b280aa5b3
Score3/10 -
- Target QtGraphicalEffects/private/qtgraphicaleffectsprivate.dll
- Size 63KB
- SHA256 fb79e480fae7edb4141f163eb4fe0424f0fdc1564492d94f166b6e19e8ca1517
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QtGraphicalEffects/qtgraphicaleffectsplugin.dll
- Size 67KB
- SHA256 35d1141a3e362a125c4770921f4e5f31dafa93602238803372c1a61be997776e
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QtLocation/declarative_location.dll
- Size 179KB
- SHA256 57637330f384d45841dbeed112f077b3a9cb0762124aef8fa85cd186d64d3e55
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QtMultimedia/declarative_multimedia.dll
- Size 272KB
- SHA256 22097c91520596c0b44755861bd72df56f5037e43e748d085bb24b318212acaf
Score1/10 -
- Target QtPositioning/declarative_positioning.dll
- Size 69KB
- SHA256 08657203092c80aaba85c24535ea655e20f3c9f4cce36288b0322160485b55c2
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QtQml/Models.2/modelsplugin.dll
- Size 26KB
- SHA256 694fa781800fefe222b715e8566cb69a618295a436f397e3f1b5d0fe88433d50
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QtQml/RemoteObjects/qtqmlremoteobjects.dll
- Size 34KB
- SHA256 569d0f1430cd3a163961c900256b6ddb25bf242da203a431b88232969c26782e
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QtQml/StateMachine/qtqmlstatemachine.dll
- Size 76KB
- SHA256 2eeebb8c10f861840ef77951ca004f30dd12c7b43c676b50f30fd878c9e373f6
Score1/10 -
- Target QtQml/WorkerScript.2/workerscriptplugin.dll
- Size 26KB
- SHA256 9e3d70389d08f55b3606526f5baeed81843a0a179ac286b9718861c650c8f1db
Score1/10 -
- Target QtQml/qmlplugin.dll
- Size 26KB
- SHA256 7453b777b0dfc4d7260dc809b1b513f645904ffd0ba864c152a34fc8b3262759
Score1/10