Overview

overview

10

Static

static

Calculation.lnk

windows7-x64

3

Calculation.lnk

windows10-2004-x64

3

look/alsoThere.js

windows7-x64

3

look/alsoThere.js

windows10-2004-x64

1

look/forLook.bat

windows7-x64

1

look/forLook.bat

windows10-2004-x64

1

look/youIn.dll

windows7-x64

1

look/youIn.dll

windows10-2004-x64

1

more/myTheir.bat

windows7-x64

1

more/myTheir.bat

windows10-2004-x64

1

more/seeSay.js

windows7-x64

3

more/seeSay.js

windows10-2004-x64

1

more/veryAs.dll

windows7-x64

10

more/veryAs.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Calculation#8785.iso

  • Size

    1014KB

  • Sample

    220916-vrdz1sgcd3

  • MD5

    43a7e6abe10774f7b5dcdbc479e9742b

  • SHA1

    a293a24763dbdc78e71a93ca75fa635512710b37

  • SHA256

    75f51c1238d8064298f231d387892c58bca859ec7087fd10e6e1a0a493f6f30a

  • SHA512

    d288b44610a2ef15ed99caae725b61e27edbbd920f23895d41cb86270ca16a441801a99e448dba2621345560649c91692de6967f96edbf9239d214d1f35a0749

  • SSDEEP

    24576:FwadVwjHYHHWHCrwUwvPwewGHHQkg1H5wbgnS/4j5+/xH9YQUoIs95:FwadVwjHYHHWHCrwUwXwewGHHQkg1H5g

Score
10/10
qakbotobama2041663313119bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.892

Botnet

obama204

Campaign

1663313119

C2

119.82.111.158:443

134.35.10.207:443

200.161.62.126:32101

70.51.132.197:2222

78.100.228.93:995

78.100.225.34:2222

45.51.148.111:993

186.154.92.181:443

66.181.164.43:443

217.165.85.223:993

70.49.33.200:2222

193.3.19.37:443

41.96.56.224:443

99.232.140.205:2222

88.231.221.198:995

76.169.76.44:2222

68.53.110.74:995

196.64.237.138:443

190.44.40.48:995

72.88.245.71:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Calculation.lnk

    • Size

      1KB

    • MD5

      83047fcbd32faf8b63fa7569cb189eac

    • SHA1

      e8dfee12e6ce8cbed5d35fecbbc7720fd7f3a542

    • SHA256

      9669b5b6827e01a6bf30f0d4a72228ca73c162a96206f65e1c514b42e43a7ea2

    • SHA512

      6bc31025c40323af209e7d75ed8eea57c692061bf4a71ac1af2db98e70d7d7d753b712e018970aab850464aaeadddfc3318d2b0b339405a5ae40c809f4bacd93

    Score
    3/10
    behavioral1behavioral2

    • Target

      look/alsoThere.js

    • Size

      216B

    • MD5

      0769476a8d0b51cfe367cfa61de77779

    • SHA1

      93cf64d74a994fe311fc234e2b3b673665860ecc

    • SHA256

      3ad606d88ceb522e228027f6b3bc2e614f1fed8ec6d50a435cb96a4ba53daf72

    • SHA512

      46d98e080f51b0f972ae1d2fd2c28948669e616fed4f4afb7653cc88371f05e93dad2097ebe1f2a092175164ca8e6b9b7b51c69a6be286c9ba80d9681e31cbb6

    Score
    3/10
    behavioral3behavioral4

    • Target

      look/forLook.bat

    • Size

      40B

    • MD5

      e1db4cee84ea3e1523a97120a55f8320

    • SHA1

      10d6450de83ce5f6979744e8d480322ab0492878

    • SHA256

      31a1c694725a4686449cf63248e5a9e3adbdcd90a6aa80bc6614bf2ecf9d0000

    • SHA512

      fdfb286b6c2112dfcf010b9130b0055f3481e061a7c0f41cd8bc88a849e30747858913184c7e90bf15a83ceaa3c2038437d6a38f6ba117a2817ee1a064ccd7cf

    Score
    1/10
    behavioral5behavioral6

    • Target

      look/youIn.db

    • Size

      3KB

    • MD5

      b83bebd6d4214aaddb333d720a56db15

    • SHA1

      fe7562e8deb7a4ae47e5183cab2ee6e053a05bc2

    • SHA256

      d0a3cdc531a3c40b67d9ff093dc96a19db3f5fe52d718468988b67f999b53411

    • SHA512

      f19788a9417bfb3fed7326e7ff29b690217f354d02912fdf8460f7f0e9a3fe17aeab540f4b014d0996cff22fa9c2aaec73725a50c999f6cefed28d09d6dd2286

    Score
    1/10
    behavioral7behavioral8

    • Target

      more/myTheir.bat

    • Size

      41B

    • MD5

      fa3b1793395d3ab2ad07026946c6f63c

    • SHA1

      14634adafb77059eb8e1f2f60982f2c5c66a9e0d

    • SHA256

      84259c767849c01f7835ab24b67b174aa9ecab7ac0a7cbea645e05dec61c41ef

    • SHA512

      d73b765f032e40ac687b5ab98aa7a7b31856c3c6e9c6dbe7bc6bf382946cec2d4da147110f6f82594add34ee8b10cce7b2f8ac3b5cdc5139ff2ba9ac193997dc

    Score
    1/10
    behavioral9behavioral10

    • Target

      more/seeSay.js

    • Size

      216B

    • MD5

      48e260c8ca60228ffe7904ded4f1f9f4

    • SHA1

      1eace5681da17b2435b6a4b503a6bcff681c6e49

    • SHA256

      0832995022d1551cda9ab1db4517b963727bba0a23d9e194a292461de76267ad

    • SHA512

      6aa8e611ba3cbb8e65d52dc60a44fce6fcc99b02873dbdd5721ed0e5696a63205ddf4bf78f4cc2412f4551d6c69f05c46ccc7b5d57132d56c5dae914f9308a30

    Score
    3/10
    behavioral11behavioral12

    • Target

      more/veryAs.db

    • Size

      484KB

    • MD5

      124405e8f46a33ff523128b208c951d7

    • SHA1

      6a8b07b7459e5e8ca16f659dbaa0ad4a7e055dd5

    • SHA256

      9339df4f96d6439a812e8f080b7fe0dd6e7594ac64d66bdfc99e3b6aa1442aa9

    • SHA512

      b1a1c329c00d2da4b67308529219c287e31a4de74319be580316a20ea73ed432198a5f5857a29cc3cecb74d7380764c1e38ecb1322671b72abf5c8def2dce1e0

    • SSDEEP

      12288:A4/Wg5+3McbxH1yWmG2dOsG8ZoxRZ6s95r:A4j5+/xH9YQUoIs95

    Score
    10/10
    qakbotobama2041663313119bankerstealertrojan
    behavioral13behavioral14

MITRE ATT&CK Enterprise v6

Tasks