Overview

overview

10

Static

static

b0a2df285e...3a.dll

windows7_x64

10

b0a2df285e...3a.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0a2df285e3c2ebec59bf7827db9c6e6169850eb846d212ed71f469ac561643a

  • Size

    675KB

  • Sample

    210517-qcalbpyfra

  • MD5

    935e97076089beae8f61e5e1487fb3b2

  • SHA1

    44b3b3398ca306d20a9b28b0f7566ae80fc4f0ec

  • SHA256

    b0a2df285e3c2ebec59bf7827db9c6e6169850eb846d212ed71f469ac561643a

  • SHA512

    a09a323c50110c55b34a7fccb980be7bf4029ac430c8bdf190e17ee4d202cf169b7c9d14d23aa054465adadb559b2fa1fe4282591f99080c8e91e08b24b6f938

Score
10/10
qakbotclinton161620911967bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

clinton16

Campaign

1620911967

C2

71.41.184.10:3389

216.201.162.158:443

95.77.223.148:443

71.74.12.34:443

86.220.62.251:2222

24.229.150.54:995

24.55.112.61:443

76.25.142.196:443

136.232.34.70:443

149.28.99.97:443

45.63.107.192:2222

45.63.107.192:443

149.28.99.97:2222

149.28.99.97:995

45.63.107.192:995

86.248.16.253:2222

86.160.137.225:443

75.67.192.125:443

140.82.49.12:443

47.22.148.6:443

Targets

    • Target

      b0a2df285e3c2ebec59bf7827db9c6e6169850eb846d212ed71f469ac561643a

    • Size

      675KB

    • MD5

      935e97076089beae8f61e5e1487fb3b2

    • SHA1

      44b3b3398ca306d20a9b28b0f7566ae80fc4f0ec

    • SHA256

      b0a2df285e3c2ebec59bf7827db9c6e6169850eb846d212ed71f469ac561643a

    • SHA512

      a09a323c50110c55b34a7fccb980be7bf4029ac430c8bdf190e17ee4d202cf169b7c9d14d23aa054465adadb559b2fa1fe4282591f99080c8e91e08b24b6f938

    Score
    10/10
    qakbotclinton161620911967bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks