Overview

overview

10

Static

static

http://lindentowncen...

windows10_x64

10

Resubmissions

19-05-2020 20:18

200519-j522lppzqx 10

19-05-2020 20:14

200519-ahdbsfbx26 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://lindentowncenter.com/xnvejyacq/2767/Darlehensvertrag_2767_18052020.zip

  • Sample

    200519-j522lppzqx

Score
10/10
qakbotspx1221589882380bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

spx122

Campaign

1589882380

C2

72.183.129.56:443

72.190.101.70:443

74.75.216.202:443

47.40.244.237:443

209.182.121.133:2222

85.121.42.12:995

203.213.104.25:995

98.118.156.172:443

74.215.201.122:443

67.250.184.157:443

79.78.131.124:443

108.54.205.207:443

72.224.213.98:2222

24.27.82.216:2222

188.26.156.131:443

41.228.239.54:443

5.36.67.194:443

101.108.119.168:443

5.13.141.223:443

105.101.126.6:443

Targets

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks