Overview

overview

10

Static

static

e87605af10...81.exe

windows7_x64

10

e87605af10...81.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e87605af102a3c4899337d12a405a3cdc5591f7133a253bbe878d8de50917b81

  • Size

    757KB

  • Sample

    210518-3mswxjew4s

  • MD5

    59e1f223e571f791af580984055758ff

  • SHA1

    2e4b439643f446ef6010f090bfc7433a13fad50d

  • SHA256

    e87605af102a3c4899337d12a405a3cdc5591f7133a253bbe878d8de50917b81

  • SHA512

    b822b968553773e2552cd9cff26f04efb431be95fd286781ad14efb9e84b280da6a9781edc97d298410806aef7d12a8614721301ee91960e1bfc3077d07f939f

Score
10/10
qakbot1573401612bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

323.91

Campaign

1573401612

Credentials

  • Protocol:     ftp
  • Host:
    192.185.5.208
  • Port:
    21
  • Username:
    logger@dustinkeeling.com
  • Password:
    NxdkxAp4dUsY

  • Protocol:     ftp
  • Host:
    162.241.218.118
  • Port:
    21
  • Username:
    logger@misterexterior.com
  • Password:
    EcOV0DyGVgVN

  • Protocol:     ftp
  • Host:
    69.89.31.139
  • Port:
    21
  • Username:
    cpanel@vivekharris-architects.com
  • Password:
    fcR7OvyLrMW6!

  • Protocol:     ftp
  • Host:
    169.207.67.14
  • Port:
    21
  • Username:
    cpanel@dovetailsolar.com
  • Password:
    eQyicNLzzqPN
C2

50.246.229.50:443

74.134.35.54:443

75.110.219.10:443

65.16.241.150:443

74.134.4.236:443

182.56.93.78:995

184.191.62.78:443

76.181.237.223:443

2.50.41.185:443

107.12.140.181:443

72.29.181.77:2078

73.137.187.150:443

71.93.60.90:443

72.46.151.196:995

173.233.182.249:443

67.10.18.112:993

181.47.60.21:995

97.83.66.143:443

184.74.101.234:995

181.1.204.139:443

Targets

    • Target

      e87605af102a3c4899337d12a405a3cdc5591f7133a253bbe878d8de50917b81

    • Size

      757KB

    • MD5

      59e1f223e571f791af580984055758ff

    • SHA1

      2e4b439643f446ef6010f090bfc7433a13fad50d

    • SHA256

      e87605af102a3c4899337d12a405a3cdc5591f7133a253bbe878d8de50917b81

    • SHA512

      b822b968553773e2552cd9cff26f04efb431be95fd286781ad14efb9e84b280da6a9781edc97d298410806aef7d12a8614721301ee91960e1bfc3077d07f939f

    Score
    10/10
    qakbot1573401612bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks