Overview

overview

10

Static

static

50600999_420925.img

windows7-x64

10

50600999_420925.img

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    50600999_420925.img

  • Size

    2.6MB

  • Sample

    220822-j69vfsgae3

  • MD5

    5531d308f169eb4387f80202b68333a0

  • SHA1

    bac447aa3281946bca9c501d8c18fcf2f5a1c0d1

  • SHA256

    81343a9be0c301685f76fa2185dc8b28c0e8aebdca6f23ba12a4412685e286f6

  • SHA512

    75ef718691db75eebc044590c499982acd1a83e9986eb0be15a951ed5ccc7401a58a5d7a146989977bb32180e4a2f0c44913b1adc54641e50a4bbb3d9b0e85ad

  • SSDEEP

    24576:D80Ra7rJwVXWqZLSPZF5BQjaM+R4YENZrfrzfQ/D6CJ0:Dt8kRKZ29+I4/DLJ

Score
10/10
qakbotobama1861654596660bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.694

Botnet

obama186

Campaign

1654596660

C2

67.165.206.193:993

63.143.92.99:995

74.14.5.179:2222

182.191.92.203:995

197.89.8.51:443

89.101.97.139:443

86.97.9.190:443

124.40.244.115:2222

80.11.74.81:2222

41.215.153.104:995

179.100.20.32:32101

31.35.28.29:443

202.134.152.2:2222

109.12.111.14:443

93.48.80.198:995

120.150.218.241:995

41.38.167.179:995

177.94.57.126:32101

173.174.216.62:443

1.161.101.20:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      50600999_420925.img

    • Size

      2.6MB

    • MD5

      5531d308f169eb4387f80202b68333a0

    • SHA1

      bac447aa3281946bca9c501d8c18fcf2f5a1c0d1

    • SHA256

      81343a9be0c301685f76fa2185dc8b28c0e8aebdca6f23ba12a4412685e286f6

    • SHA512

      75ef718691db75eebc044590c499982acd1a83e9986eb0be15a951ed5ccc7401a58a5d7a146989977bb32180e4a2f0c44913b1adc54641e50a4bbb3d9b0e85ad

    • SSDEEP

      24576:D80Ra7rJwVXWqZLSPZF5BQjaM+R4YENZrfrzfQ/D6CJ0:Dt8kRKZ29+I4/DLJ

    Score
    10/10
    qakbotobama1861654596660bankerstealertrojanevasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks