Overview

overview

10

Static

static

dc2f4aa039...86.dll

windows7_x64

10

dc2f4aa039...86.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc2f4aa039a9cee3225a8ab40bf91d5a3059ba4381dbd8b7ebf9b9dba4834286

  • Size

    1.4MB

  • Sample

    210418-g9da8lsjpj

  • MD5

    9f04abc85aca9e32b8886ab0a68be90f

  • SHA1

    0a881779b176ae84e981e87b99f23f95372a5da8

  • SHA256

    dc2f4aa039a9cee3225a8ab40bf91d5a3059ba4381dbd8b7ebf9b9dba4834286

  • SHA512

    05d1d73492b3fd137827585b7082795fa99c7c7fabcab81da814f53b768f389b05a9c578e557eed7e70ae6257dae23d34aca54489deeb7cc5f10ecc9426fb28d

Score
10/10
qakbotnotset1618398961bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1618398961

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Targets

    • Target

      dc2f4aa039a9cee3225a8ab40bf91d5a3059ba4381dbd8b7ebf9b9dba4834286

    • Size

      1.4MB

    • MD5

      9f04abc85aca9e32b8886ab0a68be90f

    • SHA1

      0a881779b176ae84e981e87b99f23f95372a5da8

    • SHA256

      dc2f4aa039a9cee3225a8ab40bf91d5a3059ba4381dbd8b7ebf9b9dba4834286

    • SHA512

      05d1d73492b3fd137827585b7082795fa99c7c7fabcab81da814f53b768f389b05a9c578e557eed7e70ae6257dae23d34aca54489deeb7cc5f10ecc9426fb28d

    Score
    10/10
    qakbotnotset1618398961bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks