Loading... Additional Content is being loaded
Windows
Analysis Report
ProjectFunding_450726_Jun01.js
Overview
General Information
| Sample Name: | ProjectFunding_450726_Jun01.js |
| Analysis ID: | 880006 |
| MD5: | a657553449746c482dacfe3b19119b7a |
| SHA1: | 630b815d443f8f7ef7e4c4c7c100de1cd8a7ed53 |
| SHA256: | 44e029dd6210c4906a82e1f16dd5ebed434efd225dafb92fc560e6ff6d1ee948 |
| Tags: | js |
| Infos: |  |
 |
|
Detection
Qbot
| Score: | 92 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Yara detected Qbot
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Writes to foreign memory regions
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Allocates memory in foreign processes
Injects a PE file into a foreign processes
C2 URLs / IPs found in malware configuration
Sample uses string decryption to hide its real strings
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
IP address seen in connection with other malware
AV process strings found (often used to terminate AV products)
Java / VBScript file with very long strings (likely obfuscated code)
PE file contains an invalid checksum
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Detected TCP or UDP traffic on non-standard ports
Connects to several IPs in different countries
Launches processes in debugging mode, may be used to hinder debugging
Checks for available system drives (often done to infect USB drives)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Classification
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| QakBot, qbotQbot | QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download. |
|
|
AV Detection |
  |
|---|
| Source: |
Malware Configuration Extractor: | ||