Try VMRay Platform
Malicious
Classifications

Injector Banking Trojan

Threat Names

Mal/Generic-S CryptOne QBot Mal/HTMLGen-A

Remarks (2/2)

(0x02000009): DLL files normally need to be submitted with an appropriate loader. Analysis result may be incomplete if an appropriate loader was not submitted.

(0x0200000E): The overall sleep time of all monitored processes was truncated from "52 days, 2 hours, 2 minutes, 58 seconds" to "6 hours, 14 minutes, 26 seconds" to reveal dormant functionality.

VMRay Threat Identifiers (24 rules, 43 matches)

ScoreCategoryOperationCountClassification
5/5
Extracted ConfigurationQBot configuration was extracted1Banking Trojan
5/5
YARAMalicious content matched by YARA rules3Banking Trojan
4/5
InjectionWrites into the memory of another process1Injector
4/5
ReputationKnown malicious file1-
4/5
ReputationContacts known malicious URL1-
4/5
ReputationContacts known malicious IP address1-
4/5
ReputationProcess command line contains known malicious IP address1-
3/5
Defense EvasionTries to detect the presence of antivirus software1-
3/5
Network ConnectionUses HTTP to upload a large amount of data.1-
3/5
HeuristicsExecutable is signed with a revoked certificate1-

Malware Configurations

Screenshots

Monitored Processes

Process GraphProcess Graph Legend

MITRE ATT&CK™ Matrix - Windows

ActiveAll
Version: 2019-04-25 20:53:07.719000
Initial Access
Execution
Windows Management Instrumentation
Persistence
Privilege Escalation
Defense Evasion
Hidden Window
Software Packing
Credential Access
Discovery
Security Software Discovery
System Information Discovery
System Network Configuration Discovery
Process Discovery
Lateral Movement
Collection
Command and Control
Standard Application Layer Protocol
Uncommonly Used Port
Exfiltration
Automated Exfiltration
Impact

Sample Information

ID#4365306
MD5
6260bbdb6c1f5d1d33557470bcabf8de
SHA1
560d6294f3e965006636e5730c65b438ac1be82b
SHA256
d2c969098c9a689728a5f5ac942fa4f75c88738d0367d471276ac4c470504ded
SSDeep
12288:LD25c7bMl3XyN6VqX1bFJf44pnlG2LniEE2DY04zyHHsPNasifQu8z:H8Aw3CowXrJf44pnw2Ln1RY04uHHsPNp
ImpHash
df2c97204ed982b8b3e7393fd2a71059
File Named2c969098c9a689728a5f5ac942fa4f75c88738d0367d471276ac4c470504ded.dll
File Size720.53 KB
Sample TypeWindows DLL (x86-32)
Verification StatusFailed
Verification ErrorThe signature hash does not match the file contents
Certificate IssuerSectigo Public Code Signing CA R36
Certificate SubjectVALENTINA SP Z O O

Analysis Information

Creation Time2022-05-16 17:05 (UTC+)
Analysis Duration00:04:00
Termination ReasonTimeout
Number of Monitored Processes18
Execution Successful
Reputation Enabled
Built-in AV Enabled
Number of AV Matches0
YARA Enabled
Number of YARA Matches183
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image