Overview

overview

10

Static

static

document-1...7.xlsb

windows7_x64

10

document-1...7.xlsb

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document-1692622327.xlsb

  • Size

    291KB

  • Sample

    201113-9rdhm8c6zj

  • MD5

    5d2586421e00a1e628c033768aa65ce3

  • SHA1

    bda641ed5d2a25102fe17d91b5c70aba8690b529

  • SHA256

    c07ad0692a9607f7c0358db479301d25f82e6d1836b5649ee458c3504fe9a27f

  • SHA512

    07981ac49e0cd274011ebb1f98adfcecfbfbd8bb8325ddfd65304706dea4219710b51e7c07df9cfc7aca420a627b42ff106b7f96af544d9a5ce670417e11cb5e

Score
10/10
qakbotsmokeloadertr011604997522backdoorbankerspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://we11wdsgd.com/

rc4.i32
rc4.i32

Extracted

Family

qakbot

Botnet

tr01

Campaign

1604997522

C2

122.61.213.85:443

2.50.89.119:995

189.183.201.0:443

86.98.145.152:2222

96.241.66.126:443

90.101.117.122:2222

94.69.112.148:2222

81.150.181.168:2222

82.127.125.209:2222

81.214.126.173:2222

86.140.82.116:20

172.87.157.235:443

176.181.247.197:443

78.97.110.47:443

5.15.90.117:2222

41.206.131.156:443

151.73.112.67:443

82.127.125.209:990

197.45.110.165:995

81.133.234.36:2222

Targets

    • Target

      document-1692622327.xlsb

    • Size

      291KB

    • MD5

      5d2586421e00a1e628c033768aa65ce3

    • SHA1

      bda641ed5d2a25102fe17d91b5c70aba8690b529

    • SHA256

      c07ad0692a9607f7c0358db479301d25f82e6d1836b5649ee458c3504fe9a27f

    • SHA512

      07981ac49e0cd274011ebb1f98adfcecfbfbd8bb8325ddfd65304706dea4219710b51e7c07df9cfc7aca420a627b42ff106b7f96af544d9a5ce670417e11cb5e

    Score
    10/10
    smokeloaderbackdoortrojanqakbottr011604997522bankerspywarestealer

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks