Overview

overview

10

Static

static

main.dll

windows7-x64

10

main.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    main.dll

  • Size

    777KB

  • Sample

    220715-3kzl5sfbh4

  • MD5

    926382093a313282f4a1639944f3fb0c

  • SHA1

    851380d94deeb031aad806795d760f3982399850

  • SHA256

    1ce7c87d8dc79ace14eb2a1be829f2d3b321b70717f723a61998ab3b9112eec8

  • SHA512

    f315d01e8475c4bc73a9c2e18c17c462b826dec66d9900534f0ccddd08f782642828fe1c2b3a04049f82c38f24cd48f419c7d1c91200ca1de32f27642ac145d3

Score
10/10
qakbotvip011657631718bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

vip01

Campaign

1657631718

C2

47.23.89.60:993

37.34.253.233:443

196.203.37.215:80

89.211.209.234:2222

81.158.239.251:2078

179.111.8.52:32101

208.107.221.224:443

24.158.23.166:995

66.230.104.103:443

92.132.132.81:2222

24.139.72.117:443

174.80.15.101:2083

24.178.196.158:2222

100.38.242.113:995

37.186.58.99:995

24.55.67.176:443

74.14.5.179:2222

172.114.160.81:443

40.134.246.185:995

63.143.92.99:995
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      main.dll

    • Size

      777KB

    • MD5

      926382093a313282f4a1639944f3fb0c

    • SHA1

      851380d94deeb031aad806795d760f3982399850

    • SHA256

      1ce7c87d8dc79ace14eb2a1be829f2d3b321b70717f723a61998ab3b9112eec8

    • SHA512

      f315d01e8475c4bc73a9c2e18c17c462b826dec66d9900534f0ccddd08f782642828fe1c2b3a04049f82c38f24cd48f419c7d1c91200ca1de32f27642ac145d3

    Score
    10/10
    qakbotvip011657631718bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks