Overview

overview

10

Static

static

04d18b5b9a...6c.dll

windows7_x64

10

04d18b5b9a...6c.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04d18b5b9ad569e90eb32d352943916c

  • Size

    1.2MB

  • Sample

    210608-xm16fhamdx

  • MD5

    04d18b5b9ad569e90eb32d352943916c

  • SHA1

    d12aeab7271d7cf01b2fa48ad66b3607706a959a

  • SHA256

    42c6b67779d0ea7895e4b480acbdda561c9e4f5faeaa87dcd3343b9cd81ad9fc

  • SHA512

    d21a34fc979ef71fc7dc1059310847488605048a4e4d5bd6d84e73106dae46813f446049f569a0201403dc4ae5f4273ff230458725a4fdbd71509e219ff2a0ed

Score
10/10
qakbotobama571623136472bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

obama57

Campaign

1623136472

C2

97.69.160.4:2222

75.67.192.125:443

86.220.62.251:2222

24.179.77.236:443

197.45.110.165:995

27.223.92.142:995

24.152.219.253:995

47.22.148.6:443

92.59.35.196:2222

136.232.34.70:443

188.26.91.212:443

149.28.101.90:2222

149.28.101.90:8443

207.246.77.75:995

45.77.115.208:2222

45.77.115.208:443

149.28.98.196:443

144.202.38.185:995

45.77.117.108:995

207.246.77.75:8443

Targets

    • Target

      04d18b5b9ad569e90eb32d352943916c

    • Size

      1.2MB

    • MD5

      04d18b5b9ad569e90eb32d352943916c

    • SHA1

      d12aeab7271d7cf01b2fa48ad66b3607706a959a

    • SHA256

      42c6b67779d0ea7895e4b480acbdda561c9e4f5faeaa87dcd3343b9cd81ad9fc

    • SHA512

      d21a34fc979ef71fc7dc1059310847488605048a4e4d5bd6d84e73106dae46813f446049f569a0201403dc4ae5f4273ff230458725a4fdbd71509e219ff2a0ed

    Score
    10/10
    qakbotobama571623136472bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks