Overview

overview

10

Static

static

lipa.dll

windows7_x64

10

lipa.dll

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lipa.dll

  • Size

    462KB

  • Sample

    210615-7phgqpb7yn

  • MD5

    e53e7e477b5fd9e6b07ef1cf23c2e9de

  • SHA1

    967abfb92d0dc3e8a0cbf3a563db32dbd1ff77c7

  • SHA256

    6c17f5a77b1ec972ce3c265fd5e86271dd846d84cfc98d8ea3a83fb437651989

  • SHA512

    1293654cb091d4f1d132554c71a20d03755236b07f3fe4a713746ddd4eb95e5cbc8dff4a947193c741175c0725e19a5f70c508c93c5d9539fb6c93bceefb4ebc

Score
10/10
qakbottr1623225382bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

tr

Campaign

1623225382

C2

190.85.91.154:443

140.82.49.12:443

105.198.236.101:443

68.186.192.69:443

24.95.61.62:443

90.65.234.26:2222

197.45.110.165:995

96.61.23.88:995

172.78.51.35:443

184.185.103.157:443

71.163.222.223:443

27.223.92.142:995

24.179.77.236:443

97.69.160.4:2222

188.26.91.212:443

75.67.192.125:443

24.152.219.253:995

92.59.35.196:2222

47.22.148.6:443

216.201.162.158:443

Targets

    • Target

      lipa.dll

    • Size

      462KB

    • MD5

      e53e7e477b5fd9e6b07ef1cf23c2e9de

    • SHA1

      967abfb92d0dc3e8a0cbf3a563db32dbd1ff77c7

    • SHA256

      6c17f5a77b1ec972ce3c265fd5e86271dd846d84cfc98d8ea3a83fb437651989

    • SHA512

      1293654cb091d4f1d132554c71a20d03755236b07f3fe4a713746ddd4eb95e5cbc8dff4a947193c741175c0725e19a5f70c508c93c5d9539fb6c93bceefb4ebc

    Score
    10/10
    qakbottr1623225382bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks