Overview

overview

10

Static

static

Xertis.dll

windows7_x64

10

Xertis.dll

windows11_x64

10

Xertis.dll

windows10_x64

10

Resubmissions

28-09-2021 20:56

210928-zqzmjsdaf8 10

24-09-2021 13:40

210924-qys1ashbd8 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Xertis.dll

  • Size

    539KB

  • Sample

    210928-zqzmjsdaf8

  • MD5

    a77ee18833f79b86262d4f4876a252a9

  • SHA1

    efcb36e4b40493ccc361541495d3084b4275f30b

  • SHA256

    68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688

  • SHA512

    89aca20e7cf76b2292e144b3c66a23c52d30701baa3a0e57f1b6338c9e0ef0376eac6902ed1f0c6b01c27afb60ce2ceabf8bbf4d855389c2626c50544b06a08f

Score
10/10
qakbotobama1021632302707bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama102

Campaign

1632302707

C2

120.150.218.241:995

47.22.148.6:443

105.198.236.99:443

95.77.223.148:443

140.82.49.12:443

27.223.92.142:995

73.151.236.31:443

136.232.34.70:443

144.139.47.206:443

45.46.53.140:2222

76.25.142.196:443

173.21.10.71:2222

75.188.35.168:443

71.74.12.34:443

96.37.113.36:993

67.165.206.193:993

189.210.115.207:443

72.252.201.69:443

24.139.72.117:443

24.229.150.54:995

Targets

    • Target

      Xertis.dll

    • Size

      539KB

    • MD5

      a77ee18833f79b86262d4f4876a252a9

    • SHA1

      efcb36e4b40493ccc361541495d3084b4275f30b

    • SHA256

      68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688

    • SHA512

      89aca20e7cf76b2292e144b3c66a23c52d30701baa3a0e57f1b6338c9e0ef0376eac6902ed1f0c6b01c27afb60ce2ceabf8bbf4d855389c2626c50544b06a08f

    Score
    10/10
    qakbotobama1021632302707bankerstealertrojan
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks