Overview

overview

10

Static

static

wayNewBy.dll

windows7_x64

10

wayNewBy.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    wayNewBy.bin

  • Size

    537KB

  • Sample

    220711-pnyx5abdg6

  • MD5

    9a2bb67af0a90c70f19289c1bde3ec0f

  • SHA1

    ab755f5be63bc573b4405bcc76803f03c14d8d9a

  • SHA256

    62653335118bb647653455b6aba600123b00a26e2b1fb74ad422b66abba60cfe

  • SHA512

    cc03ffb662ca094b12449321410dc567317446e27c34bf52ca0ac1c5937f98a68abf006b9656eaae7f60825d791c19b01bbf06f0c116cd54a0cc97d74b3a58ff

Score
10/10
qakbotobama1981656660122bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama198

Campaign

1656660122

C2

86.200.151.188:2222

41.228.22.180:443

47.23.89.60:993

129.208.0.52:995

1.161.72.70:995

39.53.124.57:995

189.78.107.163:32101

24.43.99.75:443

197.89.17.87:443

111.125.245.116:995

80.11.74.81:2222

78.180.100.59:443

86.97.209.157:2222

24.178.196.158:2222

120.150.218.241:995

100.38.242.113:995

89.101.97.139:443

93.48.80.198:995

74.14.5.179:2222

40.134.246.185:995
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      wayNewBy.bin

    • Size

      537KB

    • MD5

      9a2bb67af0a90c70f19289c1bde3ec0f

    • SHA1

      ab755f5be63bc573b4405bcc76803f03c14d8d9a

    • SHA256

      62653335118bb647653455b6aba600123b00a26e2b1fb74ad422b66abba60cfe

    • SHA512

      cc03ffb662ca094b12449321410dc567317446e27c34bf52ca0ac1c5937f98a68abf006b9656eaae7f60825d791c19b01bbf06f0c116cd54a0cc97d74b3a58ff

    Score
    10/10
    qakbotobama1981656660122bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks