Overview

overview

10

Static

static

Kaufvertra...20.vbs

windows7_x64

10

Kaufvertra...20.vbs

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Kaufvertrag_335774592927_20052020.vbs
  • Size 36.2MB
  • Sample200524-vdjbk14fbx
  • SHA256 a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44
  • MD5 SHA1 SHA512
Score
10/10
qakbotspx1241590052330bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Botnet

  • spx124

Campaign

  • 1590052330

C2

  • 188.173.185.139:443

  • 117.241.53.130:443

  • 81.103.144.77:443

  • 217.219.50.172:990

  • 103.76.160.110:443

  • 68.204.164.222:443

  • 98.32.60.217:443

  • 173.245.152.231:443

  • 72.240.245.253:443

  • 112.171.126.153:443

  • 141.85.114.172:443

  • 31.5.189.71:443

  • 71.77.231.251:443

  • 72.190.101.70:443

  • 140.82.21.191:443

  • 31.5.41.52:443

  • 78.188.109.130:443

  • 70.124.29.226:443

  • 24.43.22.220:993

  • 101.108.114.66:443

Targets

    • Target
      Kaufvertrag_335774592927_20052020.vbs
    • Size 36.2MB
    • SHA256 a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbankerstealerqakbot

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks