Overview

overview

10

Static

static

6e9fe92c8f...24.dll

windows7_x64

10

6e9fe92c8f...24.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e9fe92c8f50c441969f4df8dbe23126e902392965ef004ffd5006a3f0626124

  • Size

    770KB

  • Sample

    210311-p4zy36phy2

  • MD5

    26edc3113b5d43cd4a6304b79eeb1200

  • SHA1

    61a275ce81c332166e11ec3daa6321b4a9d53cfe

  • SHA256

    6e9fe92c8f50c441969f4df8dbe23126e902392965ef004ffd5006a3f0626124

  • SHA512

    b8f95201fa38cebc61403a684a28924ae93fb031f1bb62b4ccf29d05e035d4f6898f76883925ced449614c57be07f10a59845f1e7e0d12aa7b6986409eeae87f

Score
10/10
qakbotobama101615286191bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

obama10

Campaign

1615286191

C2

76.94.200.148:995

140.82.49.12:443

24.95.61.62:443

195.43.173.70:443

197.45.110.165:995

87.202.87.210:2222

79.115.174.55:443

196.151.252.84:443

45.118.216.157:443

77.211.30.202:995

89.3.198.238:443

47.196.192.184:443

86.175.79.249:443

80.227.5.69:443

70.168.130.172:995

83.110.108.38:2222

71.117.132.169:443

184.189.122.72:443

47.22.148.6:443

84.72.35.226:443

Targets

    • Target

      6e9fe92c8f50c441969f4df8dbe23126e902392965ef004ffd5006a3f0626124

    • Size

      770KB

    • MD5

      26edc3113b5d43cd4a6304b79eeb1200

    • SHA1

      61a275ce81c332166e11ec3daa6321b4a9d53cfe

    • SHA256

      6e9fe92c8f50c441969f4df8dbe23126e902392965ef004ffd5006a3f0626124

    • SHA512

      b8f95201fa38cebc61403a684a28924ae93fb031f1bb62b4ccf29d05e035d4f6898f76883925ced449614c57be07f10a59845f1e7e0d12aa7b6986409eeae87f

    Score
    10/10
    qakbotobama101615286191bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks