Overview

overview

10

Static

static

Report.lnk

windows7-x64

3

Report.lnk

windows10-2004-x64

3

their/makeHere.dll

windows7-x64

10

their/makeHere.dll

windows10-2004-x64

10

their/oneThink.js

windows7-x64

3

their/oneThink.js

windows10-2004-x64

1

their/someThere.bat

windows7-x64

1

their/someThere.bat

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b36c54cdc0d85d1d4c7a30ff19342915fe09cc4924c0d74b7db360df6eeb3b83

  • Size

    666KB

  • Sample

    220919-ks5h9adcdk

  • MD5

    787cec4245f2482bc6544ceb9aae59b5

  • SHA1

    5184612155a422eb46cfbd68c33f927d56e09587

  • SHA256

    b36c54cdc0d85d1d4c7a30ff19342915fe09cc4924c0d74b7db360df6eeb3b83

  • SHA512

    7929304e3da6e55ada914fe9d92b17b7a489bc6c839a3a2f0ef88fb10d0cb75bb2d6bb8fc0b117c974c779d6464d52da46312cb95c728211b1208237bd1bf4de

  • SSDEEP

    12288:6j13EEe5jhTc9RWV0ukYTO0jZtWo16VZo/2LXf7nj7:6h3CFc9RQhu6Z4o1kZpLXf7nj7

Score
10/10
qakbotbb1663241219bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.892

Botnet

BB

Campaign

1663241219

C2

81.131.161.131:2078

217.165.85.223:993

37.210.148.30:995

200.161.62.126:32101

78.100.225.34:2222

119.82.111.158:443

66.181.164.43:443

134.35.13.45:443

193.3.19.37:443

99.232.140.205:2222

197.94.210.133:443

87.243.113.104:995

84.38.133.191:443

14.184.97.67:443

123.240.131.1:443

194.166.207.160:995

78.168.87.170:2222

180.180.131.95:443

41.99.21.248:443

190.44.40.48:995
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Report.lnk

    • Size

      1KB

    • MD5

      aa8af07b93132964e11a2a225c594a1f

    • SHA1

      d27c442a29ca9d28a71149f645417e3a347908e2

    • SHA256

      9872b77e1e611ed7d7c61ea177597a174065a180f9c69934890c38175186a99c

    • SHA512

      9f4c9aa8ac24406e6c921fe5ce5625ea10d595b25bf2dea69e0abd70e543c5c76b44c1d024988b316e35ba9e9b9791ed257f7de4bab199b71a078280a5dc38fe

    Score
    3/10
    behavioral1behavioral2

    • Target

      their/makeHere.db

    • Size

      486KB

    • MD5

      8f5c7176c7d6918c65709b3473f32e01

    • SHA1

      6fe72ca7fe4e1ca97e85e08a85debe26a7a8a0fe

    • SHA256

      c302adb8d4c9b8c95d1df52b076c728c87c68d3b2103a03c9dde156aecf25f23

    • SHA512

      5727c80f9c067690a1bd84fd24f5fd06731fec45dbd08d97e0c39f925950b5a3495dbf9c73ac461d0452c555293e233276b6bbf665588566a22487e67798d329

    • SSDEEP

      12288:tj13EEe5jhTc9RWV0ukYTO0jZtWo16VZo/2LX:th3CFc9RQhu6Z4o1kZpLX

    Score
    10/10
    qakbotbb1663241219bankerstealertrojan
    behavioral3behavioral4

    • Target

      their/oneThink.js

    • Size

      165B

    • MD5

      67277bfbcf5e853984ea833f80ef3e7a

    • SHA1

      9794d0fcd0dca2780bc1c3ab98854ce12f765946

    • SHA256

      2554e865e952c0374505576fe623975859bbccb1b65f8574583a81b397a014ee

    • SHA512

      b484da9e12bef1587bdef3fda7a6c570873c3652925109f94a5be84fbd30ec014b80910c4b9c9ebf88c17db8c56d9f20f00dd5840f382b5f8621a952630c1b6f

    Score
    3/10
    behavioral5behavioral6

    • Target

      their/someThere.bat

    • Size

      44B

    • MD5

      d085144ba871e359e51a566a58456524

    • SHA1

      dce6f332e4d6d91db05551934726b23605667c2d

    • SHA256

      7fc802b18ab2bb600fc94c657185aaccb63e54242d15ca3453d96e423e4ffc1d

    • SHA512

      acf6eb5af36e8012b5a0d28c6b53e2c831770bc5a34b5856f9c0ae102a24835827282db73a2ad9dbd522c33c3d7f79f7d5f4ed50dafddecffd632cece761cc99

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks