Overview

overview

10

Static

static

main.dll

windows7-x64

10

main.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    main.dll

  • Size

    1.3MB

  • Sample

    220715-3mqf9agbbj

  • MD5

    2fce945f0621e3812618f55c4a3926e9

  • SHA1

    65aa7e9e33d25ee812e9ac86f45488c6c531d9ad

  • SHA256

    c7dfc591c7dc5371c60bd0fb1cc7ca2c14dd630a0e7272b4fac98e8d2ee5567a

  • SHA512

    95a6c8761952b43c238094fba672c0c15d011ff0af69b5100b37a52ab9b00f355337a15787fea95bd31038a4dff5a1cdfeffa70b006849f66027dcd72f2b1614

Score
10/10
qakbotvip011657721813bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

vip01

Campaign

1657721813

C2

67.209.195.198:443

63.143.92.99:995

148.64.96.100:443

72.252.157.93:990

72.252.157.93:995

89.101.97.139:443

76.25.142.196:443

47.180.172.159:443

67.165.206.193:993

32.221.224.140:995

70.46.220.114:443

176.45.218.138:995

174.69.215.101:443

24.54.48.11:443

86.97.10.37:443

81.158.239.251:2078

37.34.253.233:443

120.150.218.241:995

186.90.153.162:2222

38.70.253.226:2222
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      main.dll

    • Size

      1.3MB

    • MD5

      2fce945f0621e3812618f55c4a3926e9

    • SHA1

      65aa7e9e33d25ee812e9ac86f45488c6c531d9ad

    • SHA256

      c7dfc591c7dc5371c60bd0fb1cc7ca2c14dd630a0e7272b4fac98e8d2ee5567a

    • SHA512

      95a6c8761952b43c238094fba672c0c15d011ff0af69b5100b37a52ab9b00f355337a15787fea95bd31038a4dff5a1cdfeffa70b006849f66027dcd72f2b1614

    Score
    10/10
    qakbotvip011657721813bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks