Overview

overview

10

Static

static

guinea.db.dll

windows7-x64

10

guinea.db.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    guinea.db.dll

  • Size

    849KB

  • Sample

    220922-vqgphscac8

  • MD5

    747a50a101b528a155c8095f1aef0230

  • SHA1

    7a8c734481c95117009c57c8c81e077a2a5c5d96

  • SHA256

    01fd6e0c8393a5f4112ea19a26bedffb31d6a01f4d3fe5721ca20f479766208f

  • SHA512

    d5da3700be5c84bcb3bd3700f48d021c4fae0b0c64e8cc8fdf06d8094a4d3a497acf2fafcc05b0f6dbfa2e3e7be6d0b62c08f0328808837791ec586b7a690582

  • SSDEEP

    12288:VByskGoWHwa0nZXKlhb/H9TT+iTojfQCA3kptT68JtQzB5UT+QD1lNMAFa:SnEjYNAeh4X668Jc5w9M+a

Score
10/10
qakbotbb1663774884bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.895

Botnet

BB

Campaign

1663774884

C2

70.49.33.200:2222

181.118.183.123:443

99.232.140.205:2222

31.54.39.153:2078

173.218.180.91:443

193.3.19.37:443

134.35.8.88:443

41.97.152.42:443

70.51.132.197:2222

41.111.74.35:995

189.19.189.222:32101

105.156.139.150:443

217.165.68.59:993

119.82.111.158:443

111.125.157.230:443

125.25.129.70:443

197.94.84.128:443

177.255.14.99:995

187.205.222.100:443

190.44.40.48:995
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      guinea.db.dll

    • Size

      849KB

    • MD5

      747a50a101b528a155c8095f1aef0230

    • SHA1

      7a8c734481c95117009c57c8c81e077a2a5c5d96

    • SHA256

      01fd6e0c8393a5f4112ea19a26bedffb31d6a01f4d3fe5721ca20f479766208f

    • SHA512

      d5da3700be5c84bcb3bd3700f48d021c4fae0b0c64e8cc8fdf06d8094a4d3a497acf2fafcc05b0f6dbfa2e3e7be6d0b62c08f0328808837791ec586b7a690582

    • SSDEEP

      12288:VByskGoWHwa0nZXKlhb/H9TT+iTojfQCA3kptT68JtQzB5UT+QD1lNMAFa:SnEjYNAeh4X668Jc5w9M+a

    Score
    10/10
    qakbotbb1663774884bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks