General

  • Target

    5cfbe018afa45304fb2d7775f635101ee4226ba594bb30cc0e5c017fd1d30da1

  • Size

    596KB

  • Sample

    220801-fcmahsbddl

  • MD5

    310e65a59d3c670bc2bededf7ddef03e

  • SHA1

    77153c24512610f9ff8e00bf944a9fee8c8f2974

  • SHA256

    5cfbe018afa45304fb2d7775f635101ee4226ba594bb30cc0e5c017fd1d30da1

  • SHA512

    b2d7f3c16fa3f080a72b02b70319b1ab821a8910851e33e4655784f5371931782d58c92a2ddf37d0f5e429133b84481743f9b80a357e6a2615206c5e323d61a8

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://www.dropbox.com/s/41zf98knyy5atko/001_01.ps1?dl=1

ps1.dropper

https://www.dropbox.com/s/dh8flnrogfq1h1w/001.ps1?dl=1

Extracted

Family

qakbot

Version

322.358

Botnet

mc06

Campaign

1527585056

Credentials

  • Protocol:
    ftp
  • Host:
    37.60.244.211
  • Port:
    21
  • Username:
    backup_manager@garciasdrywall.com
  • Password:
    4AsEzIaMwi2d

  • Protocol:
    ftp
  • Host:
    198.38.77.162
  • Port:
    21
  • Username:
    backup_manager@worldexpresscargo.com
  • Password:
    kJm6DKVPfyiv

  • Protocol:
    ftp
  • Host:
    61.221.12.26
  • Port:
    21
  • Username:
    logger@ostergift.com
  • Password:
    346HZGCMlwecz9S

  • Protocol:
    ftp
  • Host:
    67.222.137.18
  • Port:
    21
  • Username:
    logger@grupocrepusculo.net
  • Password:
    p4a8k6fE1FtA3pR

  • Protocol:
    ftp
  • Host:
    107.6.152.61
  • Port:
    21
  • Username:
    logger@trussedup.com
  • Password:
    RoP4Af0RKAAQ74V
C2

71.168.229.249:995

216.21.168.27:32101

216.218.74.196:443

46.177.55.119:443

66.222.48.40:443

93.108.180.227:443

47.40.29.239:443

184.180.157.203:2222

47.40.208.189:443

71.168.229.249:443

216.93.143.182:995

98.16.70.197:2222

75.127.141.50:995

96.248.15.254:995

74.87.248.174:2222

75.189.235.216:443

66.42.182.18:995

50.252.93.122:995

105.187.37.52:443

190.137.254.188:443

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://www.dropbox.com/s/41zf98knyy5atko/001_01.ps1?dl=1

ps1.dropper

https://www.dropbox.com/s/dh8flnrogfq1h1w/001.ps1?dl=1

Targets

    • Target

      5cfbe018afa45304fb2d7775f635101ee4226ba594bb30cc0e5c017fd1d30da1

    • Size

      596KB

    • MD5

      310e65a59d3c670bc2bededf7ddef03e

    • SHA1

      77153c24512610f9ff8e00bf944a9fee8c8f2974

    • SHA256

      5cfbe018afa45304fb2d7775f635101ee4226ba594bb30cc0e5c017fd1d30da1

    • SHA512

      b2d7f3c16fa3f080a72b02b70319b1ab821a8910851e33e4655784f5371931782d58c92a2ddf37d0f5e429133b84481743f9b80a357e6a2615206c5e323d61a8

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks