download: | CO2738339304213398589.zip |
Full analysis: | https://app.any.run/tasks/e6a4d100-1eb8-48cf-a8cc-db6d371f11dc |
Verdict: | Malicious activity |
Threats: | Qbot is a banking Trojan — a malware designed to collect banking information from victims. Qbot targets organizations mostly in the US. It is equipped with various sophisticated evasion and info-stealing functions and worm-like functionality, and a strong persistence mechanism. |
Analysis date: | September 19, 2019, 08:02:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 11A7F6C742282E66E667543AEB7A420A |
SHA1: | B73F85E232200A4DDBD0DBFB92187330D830242F |
SHA256: | 08316C20A5BEDCF85622F0601912312351B9389AF7FB801BA633550DA10135A8 |
SSDEEP: | 49152:RPK5iUq9b7jT3BKkeFifHIOoAXc38PIUTwdpGWldTb3uQ26:aiUq9fjD4kdfoFAXc38PIUglF3uQ26 |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:09:18 21:50:09 |
ZipCRC: | 0x02b18855 |
ZipCompressedSize: | 2272649 |
ZipUncompressedSize: | 4483097 |
ZipFileName: | CO2738339304213398589.vbs |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3540 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\CO2738339304213398589.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3644 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3540.19888\CO2738339304213398589.vbs" | C:\Windows\System32\WScript.exe | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2556 | C:\Users\admin\AppData\Local\Temp\phOSYWGBv.exe | C:\Users\admin\AppData\Local\Temp\phOSYWGBv.exe | wmiprvse.exe | |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
3932 | C:\Users\admin\AppData\Local\Temp\phOSYWGBv.exe /C | C:\Users\admin\AppData\Local\Temp\phOSYWGBv.exe | — | phOSYWGBv.exe |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
3468 | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | — | phOSYWGBv.exe |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
1428 | "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\admin\AppData\Local\Temp\phOSYWGBv.exe" | C:\Windows\System32\cmd.exe | phOSYWGBv.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2052 | ping.exe -n 6 127.0.0.1 | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3516 | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe /C | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | — | ytfovlym.exe |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
552 | C:\Windows\explorer.exe | C:\Windows\explorer.exe | ytfovlym.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3540 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3540.19888\CO2738339304213398589.vbs | — | |
MD5:— | SHA256:— | |||
3644 | WScript.exe | C:\Users\admin\AppData\Local\Temp\udXOqnTSM.txt | — | |
MD5:— | SHA256:— | |||
552 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.dat | binary | |
MD5:B53073808F0E24BB018279DE52EF42CF | SHA256:9E97937ED42BAA9C264780FD45117B413C0E29ED8530D08C48A63CC85855BD85 | |||
3644 | WScript.exe | C:\Users\admin\AppData\Local\Temp\bqAKNWms | text | |
MD5:763D4DBA4CD15F4D03E8F2770D3DAC41 | SHA256:22DE4D49A5CC5CB185E7CA712E48A791BADBFF6F95C347C224DDDAB1000FCCC6 | |||
3644 | WScript.exe | C:\Users\admin\AppData\Local\Temp\phOSYWGBv.exe | executable | |
MD5:71375A441A725D774B9E59E5A9AAF15D | SHA256:E45BFB235195EA1C8427C5319F09B0172974700DAA31E6936AC42E23B1AFB263 | |||
3644 | WScript.exe | C:\Users\admin\AppData\Local\Temp\udXOqnTSM.txt.zip | compressed | |
MD5:93431D0415802351A7C97791C84B4EBA | SHA256:6F6DA74039DC7907C82DF44810429C9F0BE255206516F5E40E875A86B31FE089 | |||
2556 | phOSYWGBv.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | executable | |
MD5:71375A441A725D774B9E59E5A9AAF15D | SHA256:E45BFB235195EA1C8427C5319F09B0172974700DAA31E6936AC42E23B1AFB263 | |||
2556 | phOSYWGBv.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.dat | binary | |
MD5:C45BDA6AB2D37FA979640B4ABC802240 | SHA256:5589BB41E429CA02C2E8B17DF87F2E06DC3DA9F2FE3BD45FD2CC86B6ECB85E3F | |||
1428 | cmd.exe | C:\Users\admin\AppData\Local\Temp\phOSYWGBv.exe | executable | |
MD5:60B7C0FEAD45F2066E5B805A91F4F0FC | SHA256:80C10EE5F21F92F89CBC293A59D2FD4C01C7958AACAD15642558DB700943FA22 |