Extracted

• • Target
    qq-bridge-3.3.0\README.md
  • Size 7KB
  • SHA256 0ee0fdd0168694a8de475aa3222ce85991ae7794f9e3c615fde989b6ca767c28
  • MD5 7c78f7f8e0fa1799eabacabb2a5f6829
  • SHA1 99c14ca39fda325f48729b3ff240eeee6d75a61f
  • SHA512 68f9509f9f0ff9552a6b58f118eb72d0839bb4b1528e9bccfa07e43da62cb7c521d9ac52c482992054cb5081d2a6ee1de4de395d5d10fef85e9b4406809523f7
  • SSDEEP 192:3EX92jjP+Wi365C+CjG4jIE52MQAnlzsMVkni89MZyxN3r0gu2WCQFqP:3292jricCjG4jYMQAlYMf89RFPu2WCQ+
  • TLSH
    T1ADF12CEC4DBF94FB0D2A2145A5CE24ADF80CDD47EAB1ECB769E1CC7A470545240E2582
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral1behavioral2
• • Target
    qq-bridge-3.3.0\docker\entrypoint.sh
  • Size 6KB
  • SHA256 0556d4324554b3b186afba13e69aa9c468ffcc7f211c1c079b1459cbc44150a0
  • MD5 e7023921e7cbcbd9cb76c0da33d2ae5f
  • SHA1 0d80195108398bb6f7926560b51d804069d8b28a
  • SHA512 5c41bfa7fc0f1533848d3447075fc15a5274cd6ef20fc44ebbebea157b61d51b9d53a43b6652736697dbee18fc7dcdffb15e48502c2fa9983d11325b0ddebd5b
  • SSDEEP 96:KTaNkIrd06Fquc6KlXSKoIEoJp9f2DWIySErFVo2N7sd5BHeqIhM+zsrTIAr0ynJ:camMiX99ao/BNA5BHeqNkzynHp
  • TLSH
    T102E1E8D69EFD4D3121A05508ABAD00453EA2CA5B0D277CB5F09C8B282BBE7CC8D775C1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4behavioral5behavioral6
• • Target
    qq-bridge-3.3.0\docker\nas-gateway.mjs
  • Size 5KB
  • SHA256 017553a417274fa40e9c392a1a0ecb32ef3585da203253fa7783dd1b36180f5d
  • MD5 a2fbaac984f8107c976af755d0b67857
  • SHA1 113f34c649a487f814758a8feaa4e651916370d0
  • SHA512 004fb5531a3b03c4f5f8cf6ef2a6ab9f63bef2e70b4040a882a539fabb95c72ed11310f17000f1809e72be0e0d4f530abfec5e0cf390d6c15f07316988b1fbfc
  • SSDEEP 96:LVcWc59kHvZnNOaHzOPaqvW+46ZRi6TDTqd7yP44EqdweI2q2LMi3OVCBQiKPCyV:fHOa3qvXRiMDWhyA8NI+LMi3RQ5CyTZH
  • TLSH
    T1A8B16455A9F3112593B3A2DD8717DD0AB276E003A006E850F76C920A3FD522CD6F35CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral7behavioral8
• • Target
    qq-bridge-3.3.0\install-napcat.cmd
  • Size 531B
  • SHA256 f952777d2139f80099eb370b1a3fed1a4619d4b275b24f95661763467abd173f
  • MD5 444e75540f741d65dfed9919fedeb120
  • SHA1 752b40cde58f6273d6c8b2cb0e513849e02ebe47
  • SHA512 47981e19c869eb1fbd67169bd7e6ea7db0ef2534400dbb5f3c65635e7d4d1dae955f5eb0e4acdecf668b19840386fe1d47ad0c8b4dc9761fe54f3499f5b56e43
  • TLSH
    T152F020298611F22868FA4E982B0D69A47F0DC1832302CA4630E7851C740D50BD03D2C4
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  behavioral10behavioral9
• • Target
    qq-bridge-3.3.0\launcher\Launcher.ps1
  • Size 70KB
  • SHA256 1284493b8acda3ec4c96a2960090572c0670c808aa2b41d1d997a03b347e784d
  • MD5 5dca8303d69b2483343e41f5a4269c6d
  • SHA1 dc9dd1ce107f49f0c873de2a33de9ecf535873d0
  • SHA512 e5ce40789ed946e02e575757e2adb721a9cc5084d9f489bb5ae5ceadc219b21336f9f10296d01014b9cd136f4147da90564a183715293dd28a7dbf7a78074001
  • SSDEEP 1536:zGRJ9886cubct8E2SKylGwg+2TkvphklJfZheCCZ8+2:zGZ8E8UuXkh6lBZc8j
  • TLSH
    T1A463F9296CAAD52501C7D06B1CADD014E8329177A609AD38FDFCC184EF995B8CFBCB94
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  executionpersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  behavioral11behavioral12
• • Target
    qq-bridge-3.3.0\launcher\bootstrap.ps1
  • Size 13KB
  • SHA256 4016187e09a7d66b3d893e1693d3d7efce51436953c5ce48a63480722b2cce90
  • MD5 61b428ca8fe00791e84db03fde8ea3c8
  • SHA1 d8983e7d0b5949c47f838083ca1f81efe87d3a65
  • SHA512 4dfba5e430e1cf614971cf2fdea97de4fb024172da59e93a4a7c9ad9fb9723cd333362170cce2e3e0948112f9ffe79339197ccc578b0cc5aa62c95953f7c8cd4
  • SSDEEP 192:YjTFjulzz+PBa9XyTt/XeeXNpDy31rHPFK9hSREsLeaOzYQiFFCQs2x24cOz86qR:YfdKiprXoxK9hSRZrq21uD
  • TLSH
    T10E52C4686CA8D95242C7C61F0CE9A24AF8D5806FC11C6F64BD5CC254BF92B3CC7AC796
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral13behavioral14
• • Target
    qq-bridge-3.3.0\launcher\lib\ProcessControl.ps1
  • Size 42KB
  • SHA256 2a8ea0a5f10217223e2c3362a0962e514f8b58dcdd4c4e783890ee6d4f0951ed
  • MD5 57fea4c7a919c928d57601edd7436062
  • SHA1 95503078c2c9b93bfd75d76a3af88a822a6953bc
  • SHA512 3b54b0d36723e16d012af09ecb4ab808cc364974c7e9d7be35451490686e4ee310d0ed974121f6e0bd44bfd6584b4acd10b2c5c642dc52edf63c4e48d670a85a
  • SSDEEP 768:jXaq1Xp1dRH9/ebicaNbp+EABL5/T26waUGpdZugQT:jXPXp1dtAbBaNt+lBL5/T26oGpdUxT
  • TLSH
    T19013C51A38DDD1760247213918CE40057D6E99A3825E5E69BDECD2C4AF90F38D3F8B86
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral15behavioral16
• • Target
    qq-bridge-3.3.0\launcher\lib\TrayAppearance.ps1
  • Size 17KB
  • SHA256 1eb31071cfe7bb8aecf03e71455d69769c7591a89c69247f26859d4e66525103
  • MD5 6b736b9b8d0c3c1c4effb6e88403a42e
  • SHA1 eff17ea8b3184fe6b0077eddb271eb297af065d9
  • SHA512 c7c07ced3c945ea3eb852b174b8f464dfa9530b2add02709f5acb4cb6f0f931b51e74cdfd8b223e34f5223752a4076680b1a7b790bfdacae93dce6c1954c86e4
  • SSDEEP 384:0vBprcKqwmqWbqqqqq2HgjQFijdya8fJjdOhJEIY1qhjfqFbTaKAEdsjpseNlAzw:wjjRhjGZAE2jO3M
  • TLSH
    T1CB82A83537179A289E93761C4F9F80456F362133A10E9E183A9EC254FF4986CCAF9B94
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral17behavioral18
• • Target
    qq-bridge-3.3.0\launcher\lib\UiWindows.ps1
  • Size 39KB
  • SHA256 d9973e93338cd2dca18735e43f20f837dccdf0a08fed6950b3bb91e7f2f105b6
  • MD5 cca0f547a1a4465baa642c11e965cc33
  • SHA1 9139d62b6c1cd72c3035f96dbe671c8474568826
  • SHA512 16f27c5252c870fa33fd8d7ae275ca127abfed4de95ffc196deaeb859804f33d32f888c49e30d17b7ffbccba8c88b297640184993f0470da482c127431554104
  • SSDEEP 768:MF6dHolZVtFGpc3GxmnJ4/3LuF09ETBj6c4Ym11zH:zFbc3GfLKZI
  • TLSH
    T1520394787965E5640683607A19EFE804BE3650736149AD64BDDEC3C0EF90BA8C3BC74A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral19behavioral20
• • Target
    qq-bridge-3.3.0\qq-bridge.cmd
  • Size 1KB
  • SHA256 6e9d6bd5576ae84eaf8f2c344d7153c91c898b31be244dfa39087ad33d025cad
  • MD5 125c5028b87ef5460225f5f0193c2e1a
  • SHA1 f77281e1a359bb001cab7b58eea0690c4364eaa9
  • SHA512 3d5600d70071fad7e4648c7a7ff58e153a56bc078cf5f7942bf278eb63c4e326c7174086b7d6fd9d8b201666d2adc4b0fc8d3455f21596ee664e3b8adb07499e
  • TLSH
    T17211EF642C1F42332D7CC570CE92B068E8440D1B934AA5A8F0DF1AD03F7D359C5C55CA
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral21behavioral22
• • Target
    qq-bridge-3.3.0\qq-bridge.exe
  • Size 100KB
  • SHA256 d28fe83cc2a9d9ed615e45678930ba780b4170c146c10f93429bcf11282d08a0
  • MD5 1704934a699a14549bb3284d6706db3e
  • SHA1 49888f39702cafd6a98cc32a90597eb0268cc89d
  • SHA512 8617878f245c6c17b97a7d5980bc0265d2a3cc9b2294bf1c8d7e786c75c1aa45efde1c676a260af8e32a4ca17e4af3ab3e05704d7cfe56282eff9b03f0a0ebd3
  • SSDEEP 3072:HQf91WOw2Ihh2uea5N/gtBRA+cRl9RbBt8dtftHEFA:k9GZUBWgtf2lDBtuftkFA
  • TLSH
    T149A3026176DA8A10E4FB0A772930436295F97FCE8C23AB1E1E4F064F5C10B46479AB77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral23behavioral24
• • Target
    qq-bridge-3.3.0\runtime\astrbot\qq_astrbot\__init__.py
  • Size 120B
  • SHA256 de7268378d74a29126c26a091b114ec6f420bbc01ef881902729524d3fe7fdee
  • MD5 9445dcb8bc980fef6eface91cf9dd844
  • SHA1 6c20a850e5985fe177b62217ffa0dc73f6b97128
  • SHA512 d9bb47c94bc37dadf3106557d1edc75ddbe70a3a354786bbb30969ca2e9b546d75b85b902111e9882756e7318f6ebaccb607b4be973373ed61721b79410dd1e4
  • TLSH
    T1D4B02B01780B011010060DCB4004E0944E308C04300B8394D2C470FE15520D2134D08D
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral25behavioral26
• • Target
    qq-bridge-3.3.0\runtime\astrbot\qq_astrbot\__main__.py
  • Size 377B
  • SHA256 ee3eea0e1f7f415868c6d164258279db9b7f611312fdfa7f521bdcbbb9f8277b
  • MD5 5c2e9738129903518a6dd887db028eb6
  • SHA1 1343cb3f9b8434c6a1884b38455004267c74da6e
  • SHA512 29676fd3adbd97f466f1e768de60e5b5f32cca1ac98b21a9aa6824aafcf6c60572388a62c0bfd57dbde29659819b4d5e4253ba7d2472ff1ed696fd8830c251ab
  • TLSH
    T183E0C0030F8792013CF0E0CF742DC0A0EB3693634E016446368C53B53FB56580AB052C
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral27behavioral28
• • Target
    qq-bridge-3.3.0\runtime\astrbot\qq_astrbot\acl.py
  • Size 23KB
  • SHA256 380ce554d74fbfba3a3ffdfcd36e94c65b530620de459d8dc73fe6eb531a0f34
  • MD5 edad5cdc004784c62869bc00ee5dc80c
  • SHA1 574c37edc916a91cdf4e6aa68b9da84dc9edca5a
  • SHA512 7dae5eb0b161ee0054a0a7ab84a454eea9c0afa040844a4bd8453b27f3095b813d4e9609be7f85f8ba4e5c56944a008adcf63b7bd40404bc58ea08ff35b35dbc
  • SSDEEP 384:O3wcAOEqRCXY7BSpgrF3DxhQi7i2frwrOI+ubkY9OKiIinvUam5R3YHpu7pOLOjx:OAzuCXUSWrF3DjQi7i2frwrOI+up9OMd
  • TLSH
    T163B2836E8DADE42242778E5CDE03E455E32D63C32D189282BD7C5BD42F75264C2B1B8E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral29behavioral30
• • Target
    qq-bridge-3.3.0\runtime\astrbot\qq_astrbot\callback.py
  • Size 15KB
  • SHA256 ba4ca7cee7d7736b3ba02a8aec7f2502aac098c8f05d59566bb8c5439a1ffb48
  • MD5 611824ea471703b0d1586a1f2ac44560
  • SHA1 226273ac7412f3a20f6ec327d5969b8b7734ea1b
  • SHA512 66e85820e48e48355d9f80a641b28a55fb80d9a0bd4809b05ad172036cac8b405bdb4f4969cc04a5921d5c704a19759be2a0c2c9b29b614818b44af296dd30a6
  • SSDEEP 192:WvromVSCGiq29DXC1/wgEV/oT8GSDyVvR6UQHZ9ssuCwmNgnSI/jyn3qW/DZ+w8P:WDbAqt2YDeVcjHZ9s55gZ/DZQP
  • TLSH
    T1C86273A48E176B3266F6EA1E9C63A153E32A4343211C3222BCBC5BD51FF4555C7F0A9C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral31behavioral32