Overview

overview

10

Static

static

44483.5760...ac.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44483.5760884259.wac

  • Size

    500KB

  • Sample

    211015-g95zkabcfp

  • MD5

    872d4e93263614ac34a7797908b14892

  • SHA1

    2f90402569177161bad5130205dc8d8adf5dcd7d

  • SHA256

    a86818684a994827ad2bdf3e23ec65cc750c7475e88dd0c7ac95d030fc032788

  • SHA512

    b43725484cec17f47886eed8772ee1d3090028c83d4e064adff52fd0a48178aafe7e32598d2f6452f0e217ffd13684669200167e87370bc87338eef7e35fb015

Score
10/10
qakbotobama1151634197867bankerdiscoveryevasionpersistencestealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama115

Campaign

1634197867

C2

91.178.126.51:995

220.255.25.28:2222

208.78.220.143:443

77.31.162.93:443

73.230.205.91:443

216.201.162.158:443

94.200.181.154:443

24.231.209.2:2222

89.137.52.44:443

140.82.49.12:443

65.100.174.110:32103

41.86.42.158:995

27.223.92.142:995

200.232.214.222:995

81.250.153.227:2222

217.17.56.163:465

122.60.71.201:995

120.150.218.241:995

41.228.22.180:443

69.30.186.190:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      44483.5760884259.wac

    • Size

      500KB

    • MD5

      872d4e93263614ac34a7797908b14892

    • SHA1

      2f90402569177161bad5130205dc8d8adf5dcd7d

    • SHA256

      a86818684a994827ad2bdf3e23ec65cc750c7475e88dd0c7ac95d030fc032788

    • SHA512

      b43725484cec17f47886eed8772ee1d3090028c83d4e064adff52fd0a48178aafe7e32598d2f6452f0e217ffd13684669200167e87370bc87338eef7e35fb015

    Score
    10/10
    qakbotobama1151634197867bankerdiscoveryevasionpersistencestealertrojan

    • Modifies system executable filetype association

      persistence

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Registers COM server for autorun

      persistence

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

2
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

1
T1089

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks