Loading... Additional Content is being loaded
Windows
Analysis Report
Funds_160151.one
Overview
General Information
| Sample Name: | Funds_160151.one |
| Analysis ID: | 800800 |
| MD5: | 28e7fc5ae92342890d6544eb123f1b39 |
| SHA1: | 8855057b6acb24949315098ace002c99048efd10 |
| SHA256: | 2c2e8ec868c8b50a2f7a59d9948a82a9031301dfb7c41651eb35e158fedf190b |
| Infos: |   |
 |
|
Detection
Qbot
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Qbot
DLL reload attack detected
Malicious sample detected (through community Yara rule)
Sigma detected: Execute DLL with spoofed extension
Maps a DLL or memory area into another process
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Writes to foreign memory regions
Renames NTDLL to bypass HIPS
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to download and execute files (via powershell)
Suspicious powershell command line found
Allocates memory in foreign processes
Powershell drops PE file
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Drops PE files to the application program directory (C:\ProgramData)
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
PE file contains executable resources (Code or Archives)
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
AV process strings found (often used to terminate AV products)
PE file does not import any functions
PE file contains an invalid checksum
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Found evasive API chain checking for process token information
Binary contains a suspicious time stamp
Creates a start menu entry (Start Menu\Programs\Startup)
PE file overlay found
Creates a process in suspended mode (likely to inject code)
Classification
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Code function: |
15_2_1000C547 | |
Software Vulnerabilities |
  |
|---|
| Source: |
Process created: |
||
| Source: |
ASN Name: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: | ||