Overview

overview

10

Static

static

rob.html.dll

windows7_x64

10

rob.html.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rob.html.dll

  • Size

    846KB

  • Sample

    211008-wk75ysehaj

  • MD5

    3283652c1e57afef22993b466cc7440f

  • SHA1

    412262cff6773355f271be7f2a3ebc1a01d73194

  • SHA256

    5d24821c2558cc18b84c341cde0a93dc090c9311864f65e85624b5746eda560d

  • SHA512

    90501854198a1ac9145223cedfb14880ef7507b13ce2cd0ac938c940d572e13e0155fc31f77f50907a01e1787245c3dff2f3f7206bd6dd13844cba4a56d04d80

Score
10/10
qakbottr1633597626bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Targets

    • Target

      rob.html.dll

    • Size

      846KB

    • MD5

      3283652c1e57afef22993b466cc7440f

    • SHA1

      412262cff6773355f271be7f2a3ebc1a01d73194

    • SHA256

      5d24821c2558cc18b84c341cde0a93dc090c9311864f65e85624b5746eda560d

    • SHA512

      90501854198a1ac9145223cedfb14880ef7507b13ce2cd0ac938c940d572e13e0155fc31f77f50907a01e1787245c3dff2f3f7206bd6dd13844cba4a56d04d80

    Score
    10/10
    qakbottr1633597626bankerevasionstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Windows security bypass

      evasiontrojan

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks