Overview

overview

10

Static

static

8e4c0c3730...bb.dll

windows7_x64

10

8e4c0c3730...bb.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e4c0c3730667bf8dfb8c0ee23fbe8bb

  • Size

    632KB

  • Sample

    210421-gp3rrbly2e

  • MD5

    8e4c0c3730667bf8dfb8c0ee23fbe8bb

  • SHA1

    da344c94f80cfa5448782b1d5f52cd91bb59c49f

  • SHA256

    48a79cc89ec1002be655b5727c420d7a00fcdd044e0dea12e371af8804d1233f

  • SHA512

    a61d3e57b9805d4b4926de80c07442be494417bc1d444290654fa9d0bca551c00dde3f09dc1700ac124b604cb39192c307423eb81ddec75b17ba5b7cefbc7897

Score
10/10
qakbotobama301618843418bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

obama30

Campaign

1618843418

C2

83.110.109.164:2222

75.67.192.125:443

189.210.115.207:443

47.196.192.184:443

72.252.201.69:443

151.205.102.42:443

81.97.154.100:443

24.117.107.120:443

140.82.49.12:443

78.63.226.32:443

72.240.200.181:2222

75.137.47.174:443

71.41.184.10:3389

73.25.124.140:2222

149.28.101.90:8443

149.28.101.90:2222

45.77.115.208:995

45.77.115.208:8443

207.246.77.75:8443

207.246.77.75:2222

Targets

    • Target

      8e4c0c3730667bf8dfb8c0ee23fbe8bb

    • Size

      632KB

    • MD5

      8e4c0c3730667bf8dfb8c0ee23fbe8bb

    • SHA1

      da344c94f80cfa5448782b1d5f52cd91bb59c49f

    • SHA256

      48a79cc89ec1002be655b5727c420d7a00fcdd044e0dea12e371af8804d1233f

    • SHA512

      a61d3e57b9805d4b4926de80c07442be494417bc1d444290654fa9d0bca551c00dde3f09dc1700ac124b604cb39192c307423eb81ddec75b17ba5b7cefbc7897

    Score
    10/10
    qakbotobama301618843418bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks