Overview

overview

10

Static

static

veryAs.db.dll

windows7-x64

10

veryAs.db.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    veryAs.db.dll

  • Size

    484KB

  • Sample

    220916-vrdz1scacq

  • MD5

    124405e8f46a33ff523128b208c951d7

  • SHA1

    6a8b07b7459e5e8ca16f659dbaa0ad4a7e055dd5

  • SHA256

    9339df4f96d6439a812e8f080b7fe0dd6e7594ac64d66bdfc99e3b6aa1442aa9

  • SHA512

    b1a1c329c00d2da4b67308529219c287e31a4de74319be580316a20ea73ed432198a5f5857a29cc3cecb74d7380764c1e38ecb1322671b72abf5c8def2dce1e0

  • SSDEEP

    12288:A4/Wg5+3McbxH1yWmG2dOsG8ZoxRZ6s95r:A4j5+/xH9YQUoIs95

Score
10/10
qakbotobama2041663313119bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.892

Botnet

obama204

Campaign

1663313119

C2

119.82.111.158:443

134.35.10.207:443

200.161.62.126:32101

70.51.132.197:2222

78.100.228.93:995

78.100.225.34:2222

45.51.148.111:993

186.154.92.181:443

66.181.164.43:443

217.165.85.223:993

70.49.33.200:2222

193.3.19.37:443

41.96.56.224:443

99.232.140.205:2222

88.231.221.198:995

76.169.76.44:2222

68.53.110.74:995

196.64.237.138:443

190.44.40.48:995

72.88.245.71:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      veryAs.db.dll

    • Size

      484KB

    • MD5

      124405e8f46a33ff523128b208c951d7

    • SHA1

      6a8b07b7459e5e8ca16f659dbaa0ad4a7e055dd5

    • SHA256

      9339df4f96d6439a812e8f080b7fe0dd6e7594ac64d66bdfc99e3b6aa1442aa9

    • SHA512

      b1a1c329c00d2da4b67308529219c287e31a4de74319be580316a20ea73ed432198a5f5857a29cc3cecb74d7380764c1e38ecb1322671b72abf5c8def2dce1e0

    • SSDEEP

      12288:A4/Wg5+3McbxH1yWmG2dOsG8ZoxRZ6s95r:A4j5+/xH9YQUoIs95

    Score
    10/10
    qakbotobama2041663313119bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks