Overview

overview

10

Static

static

Celod.wac.dll

windows7_x64

10

Celod.wac.dll

windows10_x64

10

Resubmissions

20-10-2021 14:45

211020-r4wttaaagp 10

20-10-2021 14:42

211020-r21pzsaagn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Celod.wac

  • Size

    1.2MB

  • Sample

    211020-r4wttaaagp

  • MD5

    b010fb1ea0c950e9b14a331b0da5aac8

  • SHA1

    243989dc10c90b77ed107cbc066d8cc162fe7ab4

  • SHA256

    641d48fdf79d0513748ed7044275f35ed5fa27177e5427a38d143d1c3272c40b

  • SHA512

    6b8376162d9a7c88903280895e4efa133b3bb0a930021e52a591cab9e20c15097056a2b5a260ba9f678bf8409f1deabd687f85852dcf337e46606e4657ccf3f8

Score
10/10
qakbotbiden531634717752bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden53

Campaign

1634717752

C2

103.142.10.177:443

24.152.219.253:995

181.118.183.94:443

129.208.147.188:995

24.119.214.7:443

38.70.253.226:2222

103.143.8.71:443

77.57.204.78:443

65.100.174.110:995

220.255.25.28:2222

91.178.126.51:995

37.210.155.239:995

81.241.252.59:2078

93.48.58.123:2222

65.100.174.110:443

76.25.142.196:443

24.231.209.2:2222

140.82.49.12:443

146.66.238.74:443

39.49.4.147:995
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      Celod.wac

    • Size

      1.2MB

    • MD5

      b010fb1ea0c950e9b14a331b0da5aac8

    • SHA1

      243989dc10c90b77ed107cbc066d8cc162fe7ab4

    • SHA256

      641d48fdf79d0513748ed7044275f35ed5fa27177e5427a38d143d1c3272c40b

    • SHA512

      6b8376162d9a7c88903280895e4efa133b3bb0a930021e52a591cab9e20c15097056a2b5a260ba9f678bf8409f1deabd687f85852dcf337e46606e4657ccf3f8

    Score
    10/10
    qakbotbiden531634717752bankerevasionstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Windows security bypass

      evasiontrojan

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks