Overview

overview

10

Static

static

hret.dll

windows7_x64

10

hret.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hret.dll

  • Size

    1.8MB

  • Sample

    210611-r6kz4syxje

  • MD5

    5a6e614b4c79041ede71dc56e9d4523a

  • SHA1

    d30cd8392133d35d11704d2a1556a4572078fb0e

  • SHA256

    338b41182264fbc390c82f349f934242f85f2adcd82e37cc064855793abc01e2

  • SHA512

    7d55fa5f271690ceeb5062d6d94255a126cc863f0b1e9e4ca53ae70c6c53d32cfc0b5cdc5dd8ca057948ece318b27b2229aca72f015baaab608a16553a93a2fd

Score
10/10
qakbotobama581623325182bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

obama58

Campaign

1623325182

C2

71.41.184.10:3389

81.214.126.173:2222

50.29.166.232:995

105.198.236.101:443

86.220.62.251:2222

190.85.91.154:443

140.82.49.12:443

68.186.192.69:443

24.95.61.62:443

90.65.234.26:2222

197.45.110.165:995

96.61.23.88:995

67.165.206.193:993

184.185.103.157:443

71.163.222.223:443

24.179.77.236:443

97.69.160.4:2222

75.67.192.125:443

24.152.219.253:995

105.198.236.99:443

Targets

    • Target

      hret.dll

    • Size

      1.8MB

    • MD5

      5a6e614b4c79041ede71dc56e9d4523a

    • SHA1

      d30cd8392133d35d11704d2a1556a4572078fb0e

    • SHA256

      338b41182264fbc390c82f349f934242f85f2adcd82e37cc064855793abc01e2

    • SHA512

      7d55fa5f271690ceeb5062d6d94255a126cc863f0b1e9e4ca53ae70c6c53d32cfc0b5cdc5dd8ca057948ece318b27b2229aca72f015baaab608a16553a93a2fd

    Score
    10/10
    qakbotobama581623325182bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks