Overview

overview

10

Static

static

17e5d2175e...36.dll

windows7_x64

10

17e5d2175e...36.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17e5d2175e0f253d23066ba788fbf636.dll

  • Size

    606KB

  • Sample

    210420-fysw9vm67a

  • MD5

    17e5d2175e0f253d23066ba788fbf636

  • SHA1

    9000b6d4a6bd850e25a0eaa61dd6d2915ff6eb0e

  • SHA256

    74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056

  • SHA512

    6d197dfbc4359b4650497347e9913a0710c823ffd9cc9839cff5d9191b3a0d62791fb28af2d82879d4323cc6152f0124d0a087a328948e3074c3acdaca7221ab

Score
10/10
qakbotclinton041618322109bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

clinton04

Campaign

1618322109

C2

75.137.47.174:443

140.82.49.12:443

151.205.102.42:443

24.226.156.153:443

24.43.22.221:993

216.201.162.158:443

76.25.142.196:443

149.28.99.97:995

149.28.101.90:2222

207.246.116.237:8443

149.28.99.97:443

45.63.107.192:2222

45.32.211.207:2222

149.28.101.90:443

45.77.117.108:995

207.246.77.75:443

207.246.77.75:8443

149.28.98.196:2222

45.32.211.207:995

45.32.211.207:443

Targets

    • Target

      17e5d2175e0f253d23066ba788fbf636.dll

    • Size

      606KB

    • MD5

      17e5d2175e0f253d23066ba788fbf636

    • SHA1

      9000b6d4a6bd850e25a0eaa61dd6d2915ff6eb0e

    • SHA256

      74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056

    • SHA512

      6d197dfbc4359b4650497347e9913a0710c823ffd9cc9839cff5d9191b3a0d62791fb28af2d82879d4323cc6152f0124d0a087a328948e3074c3acdaca7221ab

    Score
    10/10
    qakbotclinton041618322109bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks