Overview

overview

10

Static

static

44481.6902...at.dll

windows7_x64

10

44481.6902...at.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44481.6902336806.dat

  • Size

    756KB

  • Sample

    211012-rmhwmacdfj

  • MD5

    acdcd26de7e78893c0b6861316721469

  • SHA1

    2f8716ea8f2747f7fdac054ec58644d6a3a175a4

  • SHA256

    e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1

  • SHA512

    84c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7

Score
10/10
qakbotobama1131634023197bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama113

Campaign

1634023197

C2

73.52.50.32:443

167.248.117.81:443

209.236.35.178:443

67.230.44.194:443

72.173.78.211:443

146.66.238.74:443

181.118.183.94:443

94.200.181.154:443

81.250.153.227:2222

69.30.186.190:443

93.48.58.123:2222

136.232.34.70:443

103.142.10.177:443

185.250.148.74:443

174.54.193.186:443

39.49.64.244:995

89.137.52.44:443

77.31.162.93:443

24.107.165.50:443

73.230.205.91:443

Targets

    • Target

      44481.6902336806.dat

    • Size

      756KB

    • MD5

      acdcd26de7e78893c0b6861316721469

    • SHA1

      2f8716ea8f2747f7fdac054ec58644d6a3a175a4

    • SHA256

      e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1

    • SHA512

      84c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7

    Score
    10/10
    qakbotobama1131634023197bankerevasionstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks