Overview

overview

10

Static

static

Art.lnk

windows7-x64

3

Art.lnk

windows10-2004-x64

3

banners/im...ion.js

windows7-x64

3

banners/im...ion.js

windows10-2004-x64

1

banners/mo...rs.cmd

windows7-x64

1

banners/mo...rs.cmd

windows10-2004-x64

1

banners/retsina.dll

windows7-x64

10

banners/retsina.dll

windows10-2004-x64

10

Resubmissions

26-09-2022 22:23

220926-2at38sdbhl 10

26-09-2022 19:56

220926-ynv1xabhd5 10

26-09-2022 18:58

220926-xmwqdabgd6 10

26-09-2022 12:36

220926-ps571abhhq 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Art#4376.zip

  • Size

    605KB

  • Sample

    220926-ps571abhhq

  • MD5

    6a793a5e8c1ab979df01b4dccde9ca32

  • SHA1

    17deb587031196f62b8d3a53c60541fd0959457d

  • SHA256

    2827772c694257f02892bfc37635cb4f7e873e598bdca9a3e43bc5dd92709543

  • SHA512

    9fe9b6a57667a2c414b32efd91e764e2ce001fb851b44bb467bd113f0a1e518f448e94d1d3fa7ad10db247cf1d065d4efabed8964bab7631a4223b3afd0fb989

  • SSDEEP

    12288:R5WRiTvdfmH2KzulB3vzZDGUIex97hr7fcrPdmgTL5qnQWW3BEKzqzccp/8H:R5L1T3vzZaCPJErPk0wn1wEIqzU

Score
10/10
qakbotbb1664184863bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.895

Botnet

BB

Campaign

1664184863

C2

197.204.227.155:443

123.23.64.230:443

173.218.180.91:443

111.125.157.230:443

70.49.33.200:2222

149.28.38.16:995

86.132.13.105:2078

149.28.38.16:443

45.77.159.252:995

45.77.159.252:443

149.28.63.197:995

144.202.15.58:443

45.63.10.144:443

45.63.10.144:995

149.28.63.197:443

144.202.15.58:995

39.121.226.109:443

177.255.14.99:995

134.35.10.30:443

99.232.140.205:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Art.lnk

    • Size

      1KB

    • MD5

      ad0431c9508e405c056ac73392abffe6

    • SHA1

      9afdfce150c89b7a3c6e54bf7391109991cc50d2

    • SHA256

      3c1d714d910f4d14eaf4698b7cec9a15a7ed92c657fb9945125bbdf3f8c767d5

    • SHA512

      e56f719b0720b1da5e492f9f625a813443b1d74016fc4afb71fb1b0dc33e9a400faf39f2a60c4d9d5ba2a9b7358bb9ddf17ee1c5ebf8f39bcb4e52af73d04010

    Score
    3/10
    behavioral1behavioral2

    • Target

      banners/impalpablePopularization.js

    • Size

      221B

    • MD5

      3fcfe2d081b471c6caaaf0d898c4868c

    • SHA1

      e674d8c8b422c616fb9680a2b8605b0a062171e6

    • SHA256

      31c56f4aa09b731e42f72f8346121922121e9b22c8de36a2a217e74a11fa43d7

    • SHA512

      82c2817684289d1202f7f88cb7f139bdf5ae9b83616388095cc04f9d878590f6bf96bb84747eba45c6c12316cbdffa99674d783ec035b34b267bbc59784586c5

    Score
    3/10
    behavioral3behavioral4

    • Target

      banners/mongoosesFavors.cmd

    • Size

      43B

    • MD5

      18ed16c7c98444c28129ba2249c2419b

    • SHA1

      3f0128c2efdb1f8803dfb0aa373aac7995eb7d8f

    • SHA256

      23c8468d2ada0f33f983ab49d0bd953a09b6deae99fec3631d1305aebf2f0f11

    • SHA512

      f6264f6538d668aa851c45b8ce9e51e3161309bdabb7553b59599c546fc942773e58f27a2854790a8128ebc27c5753f96a10a7804ba60f7901078bed59553321

    Score
    1/10
    behavioral5behavioral6

    • Target

      banners/retsina.db

    • Size

      1.1MB

    • MD5

      e17ff4c8e0da566b6fbe6ce54101eee7

    • SHA1

      ed92354f1a9500c9dc07dfe77e23d3193e905559

    • SHA256

      0b353412e79686c5185dfdf185747e856f379c863ff41d82ce0ef4b69b31b747

    • SHA512

      70b9b4f07b35cf617da318e79999d3593355c126d10ab01a30827cd0daaa0d0fe54bbc9ed8fce80372803573ad2f30ea30e177dbf9ca0eddcf4cafb87e081f30

    • SSDEEP

      24576:wVeK7bHY/DS6wku4EmQKyMeRP7IYqsS/HdcoO9u+5w9M4a:wZjMpn6oO

    Score
    10/10
    qakbotbb1664184863bankerstealertrojan
    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks