Resubmissions

04-10-2021 13:52

211004-q6lwysgdf3 10

04-10-2021 13:18

211004-qkekragda9 10

General

  • Target

    test.test

  • Size

    573KB

  • Sample

    211004-q6lwysgdf3

  • MD5

    fa3ad164c7198e0bf3747ffa1f84d074

  • SHA1

    ebdd0932906db624c500d27184fa46814354756c

  • SHA256

    0c6a5acc3823fdd07d2096562030a3818fb6001312d0daf33a61039d3acfcee7

  • SHA512

    371d472067ee1c313ea37ff1bed16375446168ca95673ce1af2803e64e20c346de9932499622f256a6485a92c806f285be22ab8fed2726da5d73b4fae26fcf44

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633334141

C2

75.75.179.226:443

185.250.148.74:443

122.11.220.212:2222

120.150.218.241:995

103.148.120.144:443

140.82.49.12:443

40.131.140.155:995

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.157.122.198:995

81.250.153.227:2222

167.248.100.227:443

96.57.188.174:2078

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

Targets

    • Target

      test.test

    • Size

      573KB

    • MD5

      fa3ad164c7198e0bf3747ffa1f84d074

    • SHA1

      ebdd0932906db624c500d27184fa46814354756c

    • SHA256

      0c6a5acc3823fdd07d2096562030a3818fb6001312d0daf33a61039d3acfcee7

    • SHA512

      371d472067ee1c313ea37ff1bed16375446168ca95673ce1af2803e64e20c346de9932499622f256a6485a92c806f285be22ab8fed2726da5d73b4fae26fcf44

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Windows security bypass

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks