Categories: PUA

PUA.QqhackRI.S25060021 information

The PUA.QqhackRI.S25060021 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA.QqhackRI.S25060021 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Attempts to modify proxy settings
Harvests cookies for information gathering

How to determine PUA.QqhackRI.S25060021?


File Info:
name: B2EC0D9A5558DD0FD76C.mlwpath: /opt/CAPEv2/storage/binaries/b0e98c99cb7851ce8b1d5e1fd5b7ec7b59aa4a4f05d8696c649a411ebf4b5c0acrc32: C71C05EFmd5: b2ec0d9a5558dd0fd76cde4c73b5de5dsha1: 6a4733acafe5c8cb73326bf81f4b88fe43c3f1bdsha256: b0e98c99cb7851ce8b1d5e1fd5b7ec7b59aa4a4f05d8696c649a411ebf4b5c0asha512: 7ab87cc2a13aad256cd1cea531b2eb60f902c05bcead814cc4488c72db124eef00a20d928c8a82930d87e8d523f93f08ca82c2ce466753700430ac6d90a28c18ssdeep: 12288:pTJf1PF53LXpMPQsl34xeDLXtN+4C7TquR:NJ9PtMZl34xcofquRtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F1B4D2044B32D802C47B5A7C0E52E7F68FDD1EA29D8AFBD84446FFD81972DE9C24605Asha3_384: ca8120228564b1ede8d31a2f71d6c8577f816753af67b87d84c990d67c08106140129c1949bad27d396bdbeb1d285ce7ep_bytes: 60be00904f008dbe0080f0ff5783cdfftimestamp: 2013-04-14 09:18:39
Version Info:
FileVersion: 2.3.0.0FileDescription: 　ProductName: QQ小助手ProductVersion: 2.3.0.0CompanyName: 　LegalCopyright: 　 版权所有Comments: 　Translation: 0x0804 0x04b0

PUA.QqhackRI.S25060021 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Graftor.303337
FireEye	Generic.mg.b2ec0d9a5558dd0f
CAT-QuickHeal	PUA.QqhackRI.S25060021
ALYac	Gen:Variant.Graftor.303337
Cylance	Unsafe
Zillya	Tool.QQHack.Win32.193
K7AntiVirus	Trojan ( 004bd1471 )
K7GW	Trojan ( 004bd1471 )
Cybereason	malicious.a5558d
BitDefenderTheta	Gen:NN.ZexaF.34084.HmMfaWqF!7ab
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/QQWare.Z
APEX	Malicious
Kaspersky	HackTool.Win32.QQHack.py
BitDefender	Gen:Variant.Graftor.303337
NANO-Antivirus	Trojan.Win32.QQHack.bropoh
Avast	Win32:Qqhack-D [PUP]
Tencent	HackTool.Win32.QQHack.a
Ad-Aware	Gen:Variant.Graftor.303337
Emsisoft	Gen:Variant.Graftor.303337 (B)
DrWeb	Trojan.Spambot.15871
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
Sophos	Generic ML PUA (PUA)
Ikarus	HackTool.Win32.QQHack
GData	Gen:Variant.Graftor.303337
Jiangmin	HackTool.QQHack.j
Avira	HEUR/AGEN.1132552
Antiy-AVL	Trojan/Generic.ASMalwS.153C37
Arcabit	Trojan.Graftor.D4A0E9
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	GenericRXAA-AA!B2EC0D9A5558
MAX	malware (ai score=89)
VBA32	BScope.Backdoor.Poison
Malwarebytes	Malware.AI.4238656223
Yandex	HackTool.QQHack!Wr96RPNYpuk
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	Riskware/Spambot
AVG	Win32:Qqhack-D [PUP]
Panda	Trj/Genetic.gen
MaxSecure	Trojan.Malware.300983.susgen