Overview

overview

10

Static

static

TXRTN_0620...55.dll

windows10_x64

10

TXRTN_0620...36.lnk

windows10_x64

10

TXRTN_0620...cs.dll

windows10_x64

10

TXRTN_0620...lc.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TXRTN_0620236.rar

  • Size

    585KB

  • Sample

    220712-xrazgacdgk

  • MD5

    dcbca1c8b9139d940609cc399d9b939c

  • SHA1

    bbb736abae07a5312d9dac4dc3dddc6035a7a01e

  • SHA256

    77689dd8ac7abb2a72720d542047f60f1fbc7a32d66c0bbd3a68220b4dad9b4d

  • SHA512

    eb08a3d18764e41969ce1a87b085506037004d33d016c42e69cac3cd801b068585f46ab898ab8d94c68f17a499b52a50f215e851a3160835afdfb530aee31e69

Score
10/10
qakbotobama2001657548298bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama200

Campaign

1657548298

C2

172.115.177.204:2222

89.101.97.139:443

186.90.153.162:2222

38.70.253.226:2222

120.150.218.241:995

72.252.157.93:995

72.252.157.93:993

94.36.193.176:2222

47.23.89.60:993

89.211.209.234:2222

76.25.142.196:443

46.100.25.239:61202

24.158.23.166:995

69.14.172.24:443

92.132.132.81:2222

37.34.253.233:443

93.48.80.198:995

174.80.15.101:2083

24.178.196.158:2222

197.89.20.137:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      TXRTN_0620236/102755.dll

    • Size

      686KB

    • MD5

      20b511612dcddebce1068aac505ce9c4

    • SHA1

      dad3a4d17d36b30cb810f103fe118b180d52a5c6

    • SHA256

      c74f98ed3ccdec5282fb3e7b93c9fd900f62b7a148c274ad866acc568e80c77c

    • SHA512

      33a0f213f7a40da841f08f50297186487ebe934f7dde43378789a23844e2fc9ec7109bacce5d22e4573a869df261645f2dbc8978081904af1efdfa694af5306b

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan
    behavioral1

    • Target

      TXRTN_0620236/TXRTN_0620236.lnk

    • Size

      1KB

    • MD5

      eea824215afd2936b4b9c428558a11ed

    • SHA1

      de5d15491319ee9c15c3bcbf215d9f6996f76776

    • SHA256

      aa1add7b438592b57f9c7e53f5c19ead55d313824822835c73ca998f8e06134d

    • SHA512

      24b0322fefbbb9eb57629f9396466cfbc79e205f126209319cd9ad2c83dda9a7975ac987058dc730e9149b6e315cfed35924e40a14a313655961bb4ed26a0b77

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral2

    • Target

      TXRTN_0620236/WindowsCodecs.dll

    • Size

      4KB

    • MD5

      491e9489c9e11f8b9d3d77239559a194

    • SHA1

      f5df8d4edfdc22646c106259c21abe8d79195e31

    • SHA256

      6e3661049bde832369781afa1d9034315442b1e4b87aa92d571cbe73186997c5

    • SHA512

      ef0bd113fe6b64d7673b33cce559bdc0cfc99c81baac78c4a15b00b7eeb07470aa36e0f29a695b615fe149858a23733015c467948d889ffbee9a1fc916e2ceae

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral3

    • Target

      TXRTN_0620236/calc.exe

    • Size

      758KB

    • MD5

      60b7c0fead45f2066e5b805a91f4f0fc

    • SHA1

      9018a7d6cdbe859a430e8794e73381f77c840be0

    • SHA256

      80c10ee5f21f92f89cbc293a59d2fd4c01c7958aacad15642558db700943fa22

    • SHA512

      68b9f9c00fc64df946684ce81a72a2624f0fc07e07c0c8b3db2fae8c9c0415bd1b4a03ad7ffa96985af0cc5e0410f6c5e29a30200efff21ab4b01369a3c59b58

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan
    behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

3
T1053

Persistence

Scheduled Task

3
T1053

Privilege Escalation

Scheduled Task

3
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks