Overview

overview

10

Static

static

102755.dll

windows7_x64

10

102755.dll

windows10-2004_x64

10

TXRTN_4654211.lnk

windows7_x64

10

TXRTN_4654211.lnk

windows10-2004_x64

7

WindowsCodecs.dll

windows7_x64

10

WindowsCodecs.dll

windows10-2004_x64

1

calc.exe

windows7_x64

10

calc.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b4c9bbd996be7e80fb07819f1e765be56c0eed5940079de70b03cde9add745e6

  • Size

    680KB

  • Sample

    220712-hm25tshhf2

  • MD5

    4258d06d96b702168296a3d06ee7e56a

  • SHA1

    6f24d0640cfe1e71fdb545992d60802966817d52

  • SHA256

    b4c9bbd996be7e80fb07819f1e765be56c0eed5940079de70b03cde9add745e6

  • SHA512

    7a98f58e728520d065d10d593825f4c76ce1e1459c01609a7da71eb1ca1d8d135316176a08f085cd94ed125d9b0a5ff99ea296a63ed42188312f32365c90c990

Score
10/10
qakbotobama2001657548298bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama200

Campaign

1657548298

C2

172.115.177.204:2222

89.101.97.139:443

186.90.153.162:2222

38.70.253.226:2222

120.150.218.241:995

72.252.157.93:995

72.252.157.93:993

94.36.193.176:2222

47.23.89.60:993

89.211.209.234:2222

76.25.142.196:443

46.100.25.239:61202

24.158.23.166:995

69.14.172.24:443

92.132.132.81:2222

37.34.253.233:443

93.48.80.198:995

174.80.15.101:2083

24.178.196.158:2222

197.89.20.137:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      102755.dll

    • Size

      686KB

    • MD5

      628bb6106d55dc762ce439e5c33b06a4

    • SHA1

      3888ef542fb1299258f83b0cd62f71d8887691e6

    • SHA256

      c0ba083bff21c52e20f97ffb1d20ada082e328d6a4f5561c10f4944f9187d375

    • SHA512

      1180a907bf5b06095d04cba610fa3571b325096b772aaec23b3cb1441200dd04ba3c824b8dfe3252e870c15a2967e8f37aea9f84f843ef27b302fe92dc760683

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      TXRTN_4654211.lnk

    • Size

      1KB

    • MD5

      eea824215afd2936b4b9c428558a11ed

    • SHA1

      de5d15491319ee9c15c3bcbf215d9f6996f76776

    • SHA256

      aa1add7b438592b57f9c7e53f5c19ead55d313824822835c73ca998f8e06134d

    • SHA512

      24b0322fefbbb9eb57629f9396466cfbc79e205f126209319cd9ad2c83dda9a7975ac987058dc730e9149b6e315cfed35924e40a14a313655961bb4ed26a0b77

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral3behavioral4

    • Target

      WindowsCodecs.dll

    • Size

      4KB

    • MD5

      491e9489c9e11f8b9d3d77239559a194

    • SHA1

      f5df8d4edfdc22646c106259c21abe8d79195e31

    • SHA256

      6e3661049bde832369781afa1d9034315442b1e4b87aa92d571cbe73186997c5

    • SHA512

      ef0bd113fe6b64d7673b33cce559bdc0cfc99c81baac78c4a15b00b7eeb07470aa36e0f29a695b615fe149858a23733015c467948d889ffbee9a1fc916e2ceae

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral5behavioral6

    • Target

      calc.exe

    • Size

      758KB

    • MD5

      60b7c0fead45f2066e5b805a91f4f0fc

    • SHA1

      9018a7d6cdbe859a430e8794e73381f77c840be0

    • SHA256

      80c10ee5f21f92f89cbc293a59d2fd4c01c7958aacad15642558db700943fa22

    • SHA512

      68b9f9c00fc64df946684ce81a72a2624f0fc07e07c0c8b3db2fae8c9c0415bd1b4a03ad7ffa96985af0cc5e0410f6c5e29a30200efff21ab4b01369a3c59b58

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral7behavioral8

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

4
T1053

Persistence

Scheduled Task

4
T1053

Privilege Escalation

Scheduled Task

4
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks