Overview

overview

10

Static

static

9

roman.exe

windows7_x64

10

roman.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    roman

  • Size

    1.9MB

  • Sample

    201109-7k64hsxzgn

  • MD5

    a4b5ac64f7b3ba1cf512f02cfd1d98a9

  • SHA1

    b759068f8c48f049975dbe1bff76571629dd5e39

  • SHA256

    0006387c4be707343f53583cdfa1511eed4afa115886d17af4cf52ed674f5681

  • SHA512

    c1761b63e703cb72a5085a839a8c624a709b4de3b744019f9231a59e4e0eeeb0af98a19ffb51319a6ef39333b57a0c4f7e8b45dc6bbb97653f47ac511f2e1ea0

Score
10/10
qakbotspx1091588257690bankercryptoneevasionpackerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

spx109

Campaign

1588257690

C2

68.204.164.222:443

47.185.134.79:443

31.5.21.66:443

24.27.82.216:2222

178.193.33.121:2222

96.250.113.218:443

148.75.231.53:443

50.89.14.94:443

50.108.212.180:443

184.57.17.74:443

58.108.188.231:443

47.41.3.40:443

47.39.177.171:2222

47.136.224.60:443

72.29.181.77:2078

94.53.92.42:443

108.227.161.27:995

203.33.139.134:443

72.204.242.138:443

47.180.66.10:443

Targets

    • Target

      roman

    • Size

      1.9MB

    • MD5

      a4b5ac64f7b3ba1cf512f02cfd1d98a9

    • SHA1

      b759068f8c48f049975dbe1bff76571629dd5e39

    • SHA256

      0006387c4be707343f53583cdfa1511eed4afa115886d17af4cf52ed674f5681

    • SHA512

      c1761b63e703cb72a5085a839a8c624a709b4de3b744019f9231a59e4e0eeeb0af98a19ffb51319a6ef39333b57a0c4f7e8b45dc6bbb97653f47ac511f2e1ea0

    Score
    10/10
    qakbotspx1091588257690bankercryptoneevasionpackerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Turns off Windows Defender SpyNet reporting

      evasion

    • Windows security bypass

      evasiontrojan

    • CryptOne packer

      Detects CryptOne packer defined in NCC blogpost.

      cryptonepacker

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks