Overview

overview

10

Static

static

10

8382b54054...39.dll

windows7_x64

10

8382b54054...39.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8382b54054b9d6d2411bb1593023b3a967d66bede6124e2c6089b62f7e48dd39

  • Size

    87KB

  • Sample

    220214-s2555shga7

  • MD5

    59f608cb5c81c770b26eab89054fe41f

  • SHA1

    4b5c407a8cd9291c834fdc12b6052d54268f139b

  • SHA256

    8382b54054b9d6d2411bb1593023b3a967d66bede6124e2c6089b62f7e48dd39

  • SHA512

    93ecc529f6104f025a589f3e47a74d95d2b11f1177d8725408ae1dfd8ee49f1175a0eef2802b5373c04fd9bb087a87329565397d49e0bc63d2b447a77b37c0aa

Score
10/10
qakbotclinton041618322109bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.1

Botnet

clinton04

Campaign

1618322109

C2

75.137.47.174:443

140.82.49.12:443

151.205.102.42:443

24.226.156.153:443

24.43.22.221:993

216.201.162.158:443

76.25.142.196:443

149.28.99.97:995

149.28.101.90:2222

207.246.116.237:8443

149.28.99.97:443

45.63.107.192:2222

45.32.211.207:2222

149.28.101.90:443

45.77.117.108:995

207.246.77.75:443

207.246.77.75:8443

149.28.98.196:2222

45.32.211.207:995

45.32.211.207:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      8382b54054b9d6d2411bb1593023b3a967d66bede6124e2c6089b62f7e48dd39

    • Size

      87KB

    • MD5

      59f608cb5c81c770b26eab89054fe41f

    • SHA1

      4b5c407a8cd9291c834fdc12b6052d54268f139b

    • SHA256

      8382b54054b9d6d2411bb1593023b3a967d66bede6124e2c6089b62f7e48dd39

    • SHA512

      93ecc529f6104f025a589f3e47a74d95d2b11f1177d8725408ae1dfd8ee49f1175a0eef2802b5373c04fd9bb087a87329565397d49e0bc63d2b447a77b37c0aa

    Score
    10/10
    qakbotclinton041618322109bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks