Overview

overview

10

Static

static

download.dll

windows7_x64

10

download.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    download.dat

  • Size

    1.7MB

  • Sample

    220125-qyc9vagfal

  • MD5

    c93d00511f737f095ec5d32603fa52ab

  • SHA1

    fd4e92245cec5b14bfc59bd496971f5397460ade

  • SHA256

    20c3a399101410c9de0fcdc46c00d88f8e18cc36163b1cf6e1377f170d752214

  • SHA512

    af232bff616470a7940b03ec85ccfbb8e9ca6a37ff003b57b0701482fbeaf96c847c748f72ac9dfbab852be3a6738094ada3826d21b584dc585d2e338c0228b7

Score
10/10
qakbotobama1521643019304bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama152

Campaign

1643019304

C2

96.80.109.57:995

209.210.95.228:32100

180.233.150.134:995

149.135.101.20:443

38.70.253.226:2222

24.222.20.254:443

83.110.2.97:443

78.87.44.54:995

86.108.46.251:443

74.15.2.252:2222

102.65.38.67:443

37.203.225.248:443

75.139.7.190:2083

24.53.49.240:443

80.14.196.176:2222

94.60.254.81:443

86.98.32.228:443

130.164.129.3:443

176.67.56.94:443

31.167.160.170:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      download.dat

    • Size

      1.7MB

    • MD5

      c93d00511f737f095ec5d32603fa52ab

    • SHA1

      fd4e92245cec5b14bfc59bd496971f5397460ade

    • SHA256

      20c3a399101410c9de0fcdc46c00d88f8e18cc36163b1cf6e1377f170d752214

    • SHA512

      af232bff616470a7940b03ec85ccfbb8e9ca6a37ff003b57b0701482fbeaf96c847c748f72ac9dfbab852be3a6738094ada3826d21b584dc585d2e338c0228b7

    Score
    10/10
    qakbotobama1521643019304bankerevasionstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks