Overview

overview

10

Static

static

URLScan

urlscan

1

https://support.plas...

windows10-2004-x64

10

Resubmissions

30-09-2022 08:06

220930-jzdtfadghm 1

29-09-2022 12:38

220929-pvf1wsbhcj 10

29-09-2022 11:14

220929-nccp3sbfbj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://support.plassertheurer.com/ws/?097410b3-3921-45e6-9eba-9bf35de0b7c8

  • Sample

    220929-pvf1wsbhcj

Score
10/10
qakbotobama2071664363417bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.895

Botnet

obama207

Campaign

1664363417

C2

217.165.146.158:993

41.97.179.58:443

86.132.13.49:2078

197.203.50.195:443

85.245.143.94:443

86.196.181.62:2222

102.190.190.242:995

105.184.133.198:995

179.111.23.186:32101

179.251.119.206:995

84.3.85.30:443

39.44.5.104:995

197.41.235.69:995

193.3.19.137:443

186.81.122.168:443

103.173.121.17:443

41.104.80.233:443

102.189.184.12:995

156.199.90.139:443

14.168.180.223:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      https://support.plassertheurer.com/ws/?097410b3-3921-45e6-9eba-9bf35de0b7c8

    Score
    10/10
    qakbotobama2071664363417bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks