Overview

overview

10

Static

static

1335950302...e6.dll

windows7_x64

10

1335950302...e6.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21660.zip

  • Size

    596KB

  • Sample

    220701-hpcb7agfhr

  • MD5

    3a3d77579dace001600a1e1f292b4a81

  • SHA1

    830aa08a8798c3197d2d17b06d58be9375fa9de8

  • SHA256

    c2f9aefb079eb96154a7c79ea33c090d70fd4a1f4cbc05bd6da4ad9c93756132

  • SHA512

    16a9bac73b392515eaf88ff52fc2c46355fce5a1492eefd4cd443de734302679a79cece4b9f63692a3bdc2cc02a7cdf78feb1d6619008ac64b2f71f3f0ce5ddc

Score
10/10
qakbotobama1891655107308bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.688

Botnet

obama189

Campaign

1655107308

C2

91.177.173.10:995

117.248.109.38:21

182.191.92.203:995

39.52.38.164:995

217.165.84.253:993

84.241.8.23:32103

82.152.39.39:443

202.134.152.2:2222

122.118.131.132:995

120.150.218.241:995

222.169.71.98:2222

37.34.253.233:443

93.48.80.198:995

148.0.55.173:443

175.145.235.37:443

41.130.140.32:993

120.61.0.71:443

89.101.97.139:443

62.204.41.187:443

62.204.41.187:2222
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      1335950302f676066881c5b060d0a654f268f50909905800c55d4f77619a2ce6

    • Size

      1.0MB

    • MD5

      183eef235da0579ab59b7ab8880ea1aa

    • SHA1

      8aa35b41f8f783a35ca0b46169eb7af9d2f4ebeb

    • SHA256

      1335950302f676066881c5b060d0a654f268f50909905800c55d4f77619a2ce6

    • SHA512

      f204b60764a3e6abb93969f53a808f9c6a6ce2f7f5091289e9dcab641f9040bd8f2111cd99b9ec1185a469c5fe03d0bc79c85c885b972ebefb39423910b9e89f

    Score
    10/10
    qakbotobama1891655107308bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks