Overview

overview

10

Static

static

44259.4602840278.dll

windows7_x64

10

44259.4602840278.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44259.4602840278.dll

  • Size

    347KB

  • Sample

    210304-4ysr8qn35s

  • MD5

    8b0af17aa90c2b5865f2285ee8280cf5

  • SHA1

    97f2166250abd3691ecf5a816f22b2995d8269a4

  • SHA256

    18ca15a469cd430aac96d87f3355528c8028ddeb41516f739d7829d5bc9e2fff

  • SHA512

    aedb879b222a037616ca05c75e408ce7e7f17b0bd1d2abaf776e415bc5bd0c9a565792016e4ac0c6009b6c5d1ae1e29eb6375db2885cc1e8f2bb899c7413f691

Score
10/10
qakbotbiden031614851222bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

biden03

Campaign

1614851222

C2

81.97.154.100:443

92.59.35.196:2222

197.161.154.132:443

75.136.26.147:443

71.117.132.169:443

78.63.226.32:443

193.248.221.184:2222

75.67.192.125:443

83.110.9.71:2222

47.22.148.6:443

89.3.198.238:443

2.232.253.79:995

45.63.107.192:2222

207.246.77.75:443

45.32.211.207:8443

207.246.77.75:8443

45.32.211.207:995

149.28.98.196:443

149.28.99.97:2222

149.28.98.196:995

Targets

    • Target

      44259.4602840278.dll

    • Size

      347KB

    • MD5

      8b0af17aa90c2b5865f2285ee8280cf5

    • SHA1

      97f2166250abd3691ecf5a816f22b2995d8269a4

    • SHA256

      18ca15a469cd430aac96d87f3355528c8028ddeb41516f739d7829d5bc9e2fff

    • SHA512

      aedb879b222a037616ca05c75e408ce7e7f17b0bd1d2abaf776e415bc5bd0c9a565792016e4ac0c6009b6c5d1ae1e29eb6375db2885cc1e8f2bb899c7413f691

    Score
    10/10
    qakbotbiden031614851222bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks