Overview

overview

10

Static

static

Post.dll

windows7_x64

10

Post.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Post.dll

  • Size

    1.2MB

  • Sample

    210608-zqs8da4fzj

  • MD5

    fe9144738951157ff31a7a5051b549a7

  • SHA1

    97c00f6d6b417294cd705ec4ac0fb58063a808f3

  • SHA256

    d5496f8422811d33219f1107ecf2d56a6b9cefe3b2312ea15040c5b9e77aa911

  • SHA512

    00f3030cd1804f3eb53517793c6b41412094826bf45127b13f28c1bd644b84ce12e74ab2042cb55f1d41d54ddffe35e54078ef573498a89dbd9dc1db1131b6ac

Score
10/10
qakbotobama571623136472bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

obama57

Campaign

1623136472

C2

97.69.160.4:2222

75.67.192.125:443

86.220.62.251:2222

24.179.77.236:443

197.45.110.165:995

27.223.92.142:995

24.152.219.253:995

47.22.148.6:443

92.59.35.196:2222

136.232.34.70:443

188.26.91.212:443

149.28.101.90:2222

149.28.101.90:8443

207.246.77.75:995

45.77.115.208:2222

45.77.115.208:443

149.28.98.196:443

144.202.38.185:995

45.77.117.108:995

207.246.77.75:8443

Targets

    • Target

      Post.dll

    • Size

      1.2MB

    • MD5

      fe9144738951157ff31a7a5051b549a7

    • SHA1

      97c00f6d6b417294cd705ec4ac0fb58063a808f3

    • SHA256

      d5496f8422811d33219f1107ecf2d56a6b9cefe3b2312ea15040c5b9e77aa911

    • SHA512

      00f3030cd1804f3eb53517793c6b41412094826bf45127b13f28c1bd644b84ce12e74ab2042cb55f1d41d54ddffe35e54078ef573498a89dbd9dc1db1131b6ac

    Score
    10/10
    qakbotobama571623136472bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks