Overview

overview

10

Static

static

102755.dll

windows7_x64

10

102755.dll

windows10-2004_x64

1

TXRTN_0699964.lnk

windows7_x64

10

TXRTN_0699964.lnk

windows10-2004_x64

10

WindowsCodecs.dll

windows7_x64

10

WindowsCodecs.dll

windows10-2004_x64

1

calc.exe

windows7_x64

10

calc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Qbot.zip

  • Size

    667KB

  • Sample

    220711-vn4q9sdee7

  • MD5

    4a8bda8b0cd4f967ba4ddacd3e870cd9

  • SHA1

    5afa086e1e78ef817d2b5f67490c4d8c7b059cc6

  • SHA256

    50c4b4ecf38e43b92293b1add79f95f61d27f1c39adea28c97d1cf98892e70b2

  • SHA512

    7dd0f0f8374d63bf7183118c1f860e60327bfd84e155560fe6be77af896c335f5a940857ca889b74b3518593022d09778179737a3348ec28940c658ed98ee46e

Score
10/10
qakbotobama2001657548298bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama200

Campaign

1657548298

C2

172.115.177.204:2222

89.101.97.139:443

186.90.153.162:2222

38.70.253.226:2222

120.150.218.241:995

72.252.157.93:995

72.252.157.93:993

94.36.193.176:2222

47.23.89.60:993

89.211.209.234:2222

76.25.142.196:443

46.100.25.239:61202

24.158.23.166:995

69.14.172.24:443

92.132.132.81:2222

37.34.253.233:443

93.48.80.198:995

174.80.15.101:2083

24.178.196.158:2222

197.89.20.137:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      102755.dll

    • Size

      686KB

    • MD5

      17bdd7bc292a529fd574945caf5d541b

    • SHA1

      c8791797ddd71c1b11fac4e7c530b1d3744be881

    • SHA256

      6dbdb80f854dbdc77d63eb2b52280c1ba592cc5a1546608ab921bde0d3ac6e5d

    • SHA512

      d4c89ab6fd187cf4e01d74d4ec32ed146ee15441af63b840e97e7bcf7032bcb6b13a668ac5aeefdf20af8a7d1c0dda52305a0e9b647b8b1dfbfa76a0a7cf57eb

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      TXRTN_0699964.lnk

    • Size

      1KB

    • MD5

      eea824215afd2936b4b9c428558a11ed

    • SHA1

      de5d15491319ee9c15c3bcbf215d9f6996f76776

    • SHA256

      aa1add7b438592b57f9c7e53f5c19ead55d313824822835c73ca998f8e06134d

    • SHA512

      24b0322fefbbb9eb57629f9396466cfbc79e205f126209319cd9ad2c83dda9a7975ac987058dc730e9149b6e315cfed35924e40a14a313655961bb4ed26a0b77

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral3behavioral4

    • Target

      WindowsCodecs.dll

    • Size

      4KB

    • MD5

      491e9489c9e11f8b9d3d77239559a194

    • SHA1

      f5df8d4edfdc22646c106259c21abe8d79195e31

    • SHA256

      6e3661049bde832369781afa1d9034315442b1e4b87aa92d571cbe73186997c5

    • SHA512

      ef0bd113fe6b64d7673b33cce559bdc0cfc99c81baac78c4a15b00b7eeb07470aa36e0f29a695b615fe149858a23733015c467948d889ffbee9a1fc916e2ceae

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral5behavioral6

    • Target

      calc.exe

    • Size

      758KB

    • MD5

      60b7c0fead45f2066e5b805a91f4f0fc

    • SHA1

      9018a7d6cdbe859a430e8794e73381f77c840be0

    • SHA256

      80c10ee5f21f92f89cbc293a59d2fd4c01c7958aacad15642558db700943fa22

    • SHA512

      68b9f9c00fc64df946684ce81a72a2624f0fc07e07c0c8b3db2fae8c9c0415bd1b4a03ad7ffa96985af0cc5e0410f6c5e29a30200efff21ab4b01369a3c59b58

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral7behavioral8

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

4
T1053

Persistence

Scheduled Task

4
T1053

Privilege Escalation

Scheduled Task

4
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks