Overview

overview

10

Static

static

newFor.db.dll

windows7-x64

10

newFor.db.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    newFor.db.dll

  • Size

    961KB

  • Sample

    220916-rwvlsabgak

  • MD5

    5f85b4cd792d6e3e2c11a7dba359a644

  • SHA1

    a77eb84fe77aea8e7dc9d75167afb2f79282679e

  • SHA256

    e716e9111e87e2f1cab16631ee561812cbf3b1c83c788ba5d293675d0959a190

  • SHA512

    1e1d1704a82bbda2a06fd304dec2b1d477f90230eb38de2158d1c9e37ffd436ac875084d2d9aca403154519743bb4df1e3dc45f2cfd74aa6cf2c7b7100310b68

  • SSDEEP

    12288:AkkiAYQjSOklPGSTHmI6S9+XruiCtDhBCaATfT0sBkPzXTwnm1cQ47glckpPWUJC:adhSlNKIybLKFBC1jNRZVdobrJLNMJx

Score
10/10
qakbotbb1663323048bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

BB

Campaign

1663323048

C2

200.161.62.126:32101

70.51.132.197:2222

78.100.228.93:995

78.100.225.34:2222

179.111.111.88:32101

102.38.97.72:995

217.165.68.125:993

193.3.19.37:443

70.49.33.200:2222

31.54.39.153:2078

99.232.140.205:2222

119.82.111.158:443

134.35.10.207:443

45.51.148.111:993

186.154.92.181:443

66.181.164.43:443

41.96.56.224:443

88.231.221.198:995

76.169.76.44:2222

68.53.110.74:995
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      newFor.db.dll

    • Size

      961KB

    • MD5

      5f85b4cd792d6e3e2c11a7dba359a644

    • SHA1

      a77eb84fe77aea8e7dc9d75167afb2f79282679e

    • SHA256

      e716e9111e87e2f1cab16631ee561812cbf3b1c83c788ba5d293675d0959a190

    • SHA512

      1e1d1704a82bbda2a06fd304dec2b1d477f90230eb38de2158d1c9e37ffd436ac875084d2d9aca403154519743bb4df1e3dc45f2cfd74aa6cf2c7b7100310b68

    • SSDEEP

      12288:AkkiAYQjSOklPGSTHmI6S9+XruiCtDhBCaATfT0sBkPzXTwnm1cQ47glckpPWUJC:adhSlNKIybLKFBC1jNRZVdobrJLNMJx

    Score
    10/10
    qakbotbb1663323048bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks