Overview

overview

10

Static

static

lipa.dll

windows7_x64

10

lipa.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lipa.dll

  • Size

    449KB

  • Sample

    210615-4qng14h94s

  • MD5

    2a73d3b181923f7386b6cebb7ddc1077

  • SHA1

    cc611c21da8380f3cd8c7218a72076a1e7dd465c

  • SHA256

    6fb7e5e1dce806ff99a335db2ee5720e2c62377232ca4eb9c3ab4e53b5012f2c

  • SHA512

    55e72b6b4825d91dc11dca17fd26207b1b0f67a8e5bdc564e4a9a7240c3e4d8ff3740b06560ac048743eaecfca05826d5534a771858a9915e07bfe88ea727fed

Score
10/10
qakbottr1623225382bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

tr

Campaign

1623225382

C2

190.85.91.154:443

140.82.49.12:443

105.198.236.101:443

68.186.192.69:443

24.95.61.62:443

90.65.234.26:2222

197.45.110.165:995

96.61.23.88:995

172.78.51.35:443

184.185.103.157:443

71.163.222.223:443

27.223.92.142:995

24.179.77.236:443

97.69.160.4:2222

188.26.91.212:443

75.67.192.125:443

24.152.219.253:995

92.59.35.196:2222

47.22.148.6:443

216.201.162.158:443

Targets

    • Target

      lipa.dll

    • Size

      449KB

    • MD5

      2a73d3b181923f7386b6cebb7ddc1077

    • SHA1

      cc611c21da8380f3cd8c7218a72076a1e7dd465c

    • SHA256

      6fb7e5e1dce806ff99a335db2ee5720e2c62377232ca4eb9c3ab4e53b5012f2c

    • SHA512

      55e72b6b4825d91dc11dca17fd26207b1b0f67a8e5bdc564e4a9a7240c3e4d8ff3740b06560ac048743eaecfca05826d5534a771858a9915e07bfe88ea727fed

    Score
    10/10
    qakbottr1623225382bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks