Overview

overview

10

Static

static

0abfa464ee...a9.dll

windows7_x64

10

0abfa464ee...a9.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9

  • Size

    1021KB

  • Sample

    210507-h3k2m5pvse

  • MD5

    2b1da17555d7ca769b77f45c8636af6d

  • SHA1

    c7fb8ba77b3ed74d3551e6e811d3df63e0da5df9

  • SHA256

    0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9

  • SHA512

    403f033da3f938a3df6ebc3f9292935b6fff1dc086bbf9535b4e928586b713d4fd6a47bbcf0cfd58e37a6cb4b0baa998e8f24078c6979032eefce70d5d4467dc

Score
10/10
qakbotobama351619617557bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

obama35

Campaign

1619617557

C2

24.117.107.120:443

75.137.47.174:443

105.198.236.101:443

81.97.154.100:443

216.201.162.158:443

71.187.170.235:443

47.196.192.184:443

136.232.34.70:443

47.22.148.6:443

75.67.192.125:443

24.229.150.54:995

172.78.40.61:443

144.139.47.206:443

71.163.222.243:443

45.63.107.192:995

24.226.156.153:443

190.85.91.154:443

71.41.184.10:3389

140.82.49.12:443

73.25.124.140:2222

Targets

    • Target

      0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9

    • Size

      1021KB

    • MD5

      2b1da17555d7ca769b77f45c8636af6d

    • SHA1

      c7fb8ba77b3ed74d3551e6e811d3df63e0da5df9

    • SHA256

      0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9

    • SHA512

      403f033da3f938a3df6ebc3f9292935b6fff1dc086bbf9535b4e928586b713d4fd6a47bbcf0cfd58e37a6cb4b0baa998e8f24078c6979032eefce70d5d4467dc

    Score
    10/10
    qakbotobama351619617557bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks