Overview

overview

10

Static

static

Report.lnk

windows7-x64

3

Report.lnk

windows10-2004-x64

3

well/evenWho.js

windows7-x64

3

well/evenWho.js

windows10-2004-x64

1

well/himGet.bat

windows7-x64

1

well/himGet.bat

windows10-2004-x64

1

well/sheUp.dll

windows7-x64

10

well/sheUp.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MainReport#899100.iso

  • Size

    806KB

  • Sample

    220915-smbb8ahbcp

  • MD5

    1047eb62052e182c790ca11f900412f0

  • SHA1

    d4c5ee83d2f106060f278047a96ac8e1c1a5afab

  • SHA256

    891f480f2f84df06829a87d24ad0c292a4f9f71c6f70817eeffb71daec641857

  • SHA512

    759050b850753f196597b28ae43d7263e25549bd9f34d5e41d15f476c8325a399bae80bd2610ff1d08c01fa0ba651767eec20d060d5fd0b5cfdfed10410e1775

  • SSDEEP

    12288:lOSe1J015+z6oZZdf/zxY5lbV6hJ84Q7yLCgsyP4bXfZ9i:4j1y5+z6oLdzxmkf8eTsc4bXfZ9i

Score
10/10
qakbotbb1663241231bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.892

Botnet

BB

Campaign

1663241231

C2

81.131.161.131:2078

217.165.85.223:993

37.210.148.30:995

200.161.62.126:32101

78.100.225.34:2222

119.82.111.158:443

66.181.164.43:443

134.35.13.45:443

193.3.19.37:443

99.232.140.205:2222

197.94.210.133:443

87.243.113.104:995

84.38.133.191:443

14.184.97.67:443

123.240.131.1:443

194.166.207.160:995

78.168.87.170:2222

180.180.131.95:443

41.99.21.248:443

190.44.40.48:995
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Report.lnk

    • Size

      1KB

    • MD5

      c3e1f33e5d29229f9e9763be8c22b63d

    • SHA1

      2301cf832768f9e929ae6b4f9b4235ad95bd4bf2

    • SHA256

      7f37613f36777a5de2c14af634f40e168b9921eab95880b004ec0fe96fabef1a

    • SHA512

      94a76816f0e3aa24660e9dfab452096e5b590af549fde8b43d62ac5a8ffb100da7e61b485b1396a8eca3cacec364bd49279a9aa004f2a978d405c329e1b2f807

    Score
    3/10
    behavioral1behavioral2

    • Target

      well/evenWho.js

    • Size

      137B

    • MD5

      7d2ab25f3817457da9d4e4e6f0c8d783

    • SHA1

      6b686a90f52ebc7388cad4e34c5605380ef0bb8d

    • SHA256

      1b51a3d64e2e573f71f3698b7393df85357be17b9890044d689d300bc7e475ce

    • SHA512

      cb56508572e48f128267a3b5d7fe17ed5503ba12b6d2c42726aac2a63576c4ab4e322b82c6215305cb9aa9a505421d6eb9d4cf52ee46f7c96c83091082d91836

    Score
    3/10
    behavioral3behavioral4

    • Target

      well/himGet.bat

    • Size

      37B

    • MD5

      f8928225bd2cea7f83d9cbccfb45ecf1

    • SHA1

      3151501702c10d03fc9e1460662fd32465f4a625

    • SHA256

      990be5575008afdbbae0a31df059ec24d9399b07d58ba0a2fa4d4a05b3071c41

    • SHA512

      f001038c43b14e229059df721bc60dd4c61d0f92f2a8af7e189dfdd87c77ce6751b245dd7dc0572103d6e03058d7e5ddbf6ff67cd3d8530ec132af919375eef5

    Score
    1/10
    behavioral5behavioral6

    • Target

      well/sheUp.db

    • Size

      639KB

    • MD5

      baa6798c1674853f7dcf003b78ee79ed

    • SHA1

      33ac6d3c9c7f82544acf9bc6785dd93346066811

    • SHA256

      01cd0c3b1d2de2223fc32d6f96ed98d198c207c19ae6cf4b22ee5af556c40f31

    • SHA512

      65757e3c02a1afb9fccb9a50b138bc811cddde2750cb104b9473e5b79bb52fd29ec9f9abd01bc0fe238005a0fcce681e96153e0d2ec80cc526ffc8d2db179db5

    • SSDEEP

      12288:GOSe1J015+z6oZZdf/zxY5lbV6hJ84Q7yLCgsy:9j1y5+z6oLdzxmkf8eTs

    Score
    10/10
    qakbotbb1663241231bankerstealertrojan
    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks