Overview

overview

10

Static

static

8

document-1...59.xls

windows7_x64

10

document-1...59.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    documentation (27).zip

  • Size

    271KB

  • Sample

    210218-gtwl8nsky6

  • MD5

    9ad49a1c003e8054f5ec39de54dca171

  • SHA1

    df19df927439d83cdfa255833a2bbc4fed38e2b3

  • SHA256

    ad6d94157dcc3666ab60e3e3b4c8b3399db6b5aa0ffd4f86c090c4e6e2289ede

  • SHA512

    cf26a441e81c3e5493883695b04d63583bf177584c850efec61c75678221cbbb83650e00dc0338ab1ee3a13190b9603df30a77c6213b17e5b494c0be2ad25e45

Score
10/10
qakbottr1613385567bankermacrostealertrojanxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://intellectsmart.in/ds/1702.gif

Extracted

Family

qakbot

Botnet

tr

Campaign

1613385567

C2

78.63.226.32:443

197.51.82.72:443

193.248.221.184:2222

95.77.223.148:443

71.199.192.62:443

77.211.30.202:995

80.227.5.69:443

77.27.204.204:995

81.97.154.100:443

173.184.119.153:995

38.92.225.121:443

81.150.181.168:2222

90.65.236.181:2222

83.110.103.152:443

73.153.211.227:443

188.25.63.105:443

89.137.211.239:995

202.188.138.162:443

98.173.34.212:995

87.202.87.210:2222

Targets

    • Target

      document-1886749459.xls

    • Size

      315KB

    • MD5

      6913e77aeb547e77d868bbf167d3b752

    • SHA1

      6eaf6fb365e609da5036d2017ee1cc165ac848fc

    • SHA256

      8c979e0996db7ae20fbb99272e57aa9d1b13ca8a440563970fe45ea04dcd2be0

    • SHA512

      9016d838bfe88532267b8133198b1d327410af695783f3f8ee04c607706f2a3437ac2e98d016c611f3e2f75853378a325d752940c31cdb4c58d5d30ae4c86394

    Score
    10/10
    qakbottr1613385567bankerstealertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks