File name: | CO4167148351463404415.zip |
Full analysis: | https://app.any.run/tasks/fec896b8-edea-4510-a7e1-f3dd1e25bb35 |
Verdict: | Malicious activity |
Threats: | Qbot is a banking Trojan — a malware designed to collect banking information from victims. Qbot targets organizations mostly in the US. It is equipped with various sophisticated evasion and info-stealing functions and worm-like functionality, and a strong persistence mechanism. |
Analysis date: | September 19, 2019, 02:43:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 242241CCB69454D5BF0A8B83274A57DB |
SHA1: | 4BFCB7435E593007514CF3AD19CB69EF1626F8FF |
SHA256: | 6F9B9CB7BDE3858B9EB099A707058038677ED12590967A5674899C3E5832E2B0 |
SSDEEP: | 49152:xu7nOTa7FhFvMe3fJ7Ny/B4qbXEU2OJm5BWG8+gLSOyHqDhpPtWcHmuzBnx:xu7dFhFUMeBH05Ze+gLS/K9plWcHmAVx |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:09:18 21:49:12 |
ZipCRC: | 0xfdfc3da8 |
ZipCompressedSize: | 2302047 |
ZipUncompressedSize: | 4546199 |
ZipFileName: | CO4167148351463404415.vbs |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3588 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\CO4167148351463404415.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
4004 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3588.5625\CO4167148351463404415.vbs" | C:\Windows\System32\WScript.exe | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3056 | C:\Users\admin\AppData\Local\Temp\COslsfINf.exe | C:\Users\admin\AppData\Local\Temp\COslsfINf.exe | wmiprvse.exe | |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
364 | C:\Users\admin\AppData\Local\Temp\COslsfINf.exe /C | C:\Users\admin\AppData\Local\Temp\COslsfINf.exe | — | COslsfINf.exe |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
3480 | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | — | COslsfINf.exe |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
1216 | "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\admin\AppData\Local\Temp\COslsfINf.exe" | C:\Windows\System32\cmd.exe | COslsfINf.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2828 | ping.exe -n 6 127.0.0.1 | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3772 | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe /C | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | — | ytfovlym.exe |
User: admin Company: Allowdone Fishbowl Inventory Integrity Level: MEDIUM Description: PlanGrass Exit code: 0 Version: 12.1.25.40 | ||||
4084 | C:\Windows\explorer.exe | C:\Windows\explorer.exe | ytfovlym.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3588 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3588.5625\CO4167148351463404415.vbs | — | |
MD5:— | SHA256:— | |||
4004 | WScript.exe | C:\Users\admin\AppData\Local\Temp\dWAaDLPk.txt | — | |
MD5:— | SHA256:— | |||
4004 | WScript.exe | C:\Users\admin\AppData\Local\Temp\dWAaDLPk.txt.zip | compressed | |
MD5:9550B25AAFD91373E866801B56DC079D | SHA256:9EAE9A24A3B1F4EB3783509B09AAF1A6F5C519B4678D4A75B6CD52835D2101AA | |||
4004 | WScript.exe | C:\Users\admin\AppData\Local\Temp\COslsfINf.exe | executable | |
MD5:71375A441A725D774B9E59E5A9AAF15D | SHA256:E45BFB235195EA1C8427C5319F09B0172974700DAA31E6936AC42E23B1AFB263 | |||
3056 | COslsfINf.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.dat | binary | |
MD5:540C2B345E62A561B669D3719C011969 | SHA256:D817CB02CCE34A397DC62462E11188D5C2253A8F95FAF1A868348D2EC08FCC23 | |||
3056 | COslsfINf.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe | executable | |
MD5:71375A441A725D774B9E59E5A9AAF15D | SHA256:E45BFB235195EA1C8427C5319F09B0172974700DAA31E6936AC42E23B1AFB263 | |||
4084 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.dat | binary | |
MD5:91BBB82CFBF6C4933BB683424859A4DC | SHA256:F4136DB9A330712101CF69E847267111E13FE45E4FFCF5A1479BAD549465ED70 | |||
4004 | WScript.exe | C:\Users\admin\AppData\Local\Temp\JSiaMkbL | text | |
MD5:BD1C27A2CF063DB3598F0325928229D6 | SHA256:24BB12EDF5B0BC94AA2ED30AC78CE9BA96CDD15AEFDAD0226EAF5572CB50B89E | |||
1216 | cmd.exe | C:\Users\admin\AppData\Local\Temp\COslsfINf.exe | executable | |
MD5:60B7C0FEAD45F2066E5B805A91F4F0FC | SHA256:80C10EE5F21F92F89CBC293A59D2FD4C01C7958AACAD15642558DB700943FA22 |