Overview

overview

10

Static

static

7965/3601.js

windows7-x64

3

7965/3601.js

windows10-2004-x64

1

7965/6388.cmd

windows7-x64

1

7965/6388.cmd

windows10-2004-x64

1

7965/usurpers.dll

windows7-x64

10

7965/usurpers.dll

windows10-2004-x64

10

ContractCopy.lnk

windows7-x64

10

ContractCopy.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ContractCopy_1144.iso

  • Size

    884KB

  • Sample

    221005-183btsgahl

  • MD5

    915bf6b267ca509a909d91312d44d216

  • SHA1

    3f86c8e455de1caeb9b62989ff5551ff8b72fd5a

  • SHA256

    e6eab533d9b34806636f700c12966f842fa081c9ca8b3765720e9d424c773e85

  • SHA512

    74858ab5aa31b52ec74c2b57a9fcd2f3f007ca75d7ee42966594e84c24c15dfa17944cb9f2706f206307d859cd616a56bbbc3c0ae1339766bfe522c0716d760a

  • SSDEEP

    12288:S2Fsmgcxnt9hlMvNICAY0KEkAOl7G79zEXjGOyw3MW:7smBt9+JFEkAmG0j26M

Score
10/10
qakbotbankerstealertrojan

Malware Config

Extracted

Family

qakbot

C2

156.36.22.250:12263

73.225.210.175:40922

19.138.81.187:38748

191.101.43.136:10968

145.20.244.169:39814

74.30.254.35:15530

138.94.26.23:49965

218.175.98.133:15428

181.245.40.43:1982

24.10.174.212:30807

253.219.195.173:1546

51.182.7.163:21304

191.68.117.56:28754

246.29.132.217:16625

149.181.112.217:33637

136.20.21.112:41199

80.65.15.199:35765

0.222.227.111:63041

209.240.1.52:53226

66.57.60.202:19263
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      7965/3601.js

    • Size

      297B

    • MD5

      2c118a6bcb30fbde2efae295413590f4

    • SHA1

      daa108443713a3371b85a99f0a9a5de2209f711c

    • SHA256

      9f82767ad3355f12c5b702d5976c565a9b7ae883d2e35b469cdde7c6d610ee28

    • SHA512

      77b653d2692f6cdf83acd6cecd1f39b4973d9a20fcb1d902ec6004dcec7e7afbb930bc1c9510fc946529db2a0cd96c31bce8997b2b70c87ce09c51bd36d1eba9

    Score
    3/10
    behavioral1behavioral2

    • Target

      7965/6388.cmd

    • Size

      173B

    • MD5

      b826322d9cc4c5998a347e78c038b6b0

    • SHA1

      f49a1db568fe826412a1c36bdb728b51f394493d

    • SHA256

      f1ee6728551f797d09b5e5ca2c1332591b8ae96d2408a8bde539df9d2b1745e1

    • SHA512

      7e7f46f6dbd38334e8dd1ece7d40d5f11c9b7ed0cb76184b8e818adc9330d49e0d432327f43964a76d8ce772b099683e07d02e4ecca1630aaf4e5d3b4a603b49

    Score
    1/10
    behavioral3behavioral4

    • Target

      7965/usurpers.dat

    • Size

      743KB

    • MD5

      0d34c7cc649e41ed139210cff4f0f6b2

    • SHA1

      2aa5538a31b7367ced7ce55dbf68c93490f7eff9

    • SHA256

      7d9d70bdc53de103086dfc901004cfa2dc93fb25fb5c40109b63ba071107e40a

    • SHA512

      8ac448a6bdf86ad781aa386895df83cb9d48536bf00140ac0c05ea55df0f783815cc8600a5e76cd38d84f980caf5ec758b46d489370d0a49dce9c0a638ebafbb

    • SSDEEP

      12288:zxnt9hlMvNICAY0KEkAOl7G79zEXjGOyw3MW:tt9+JFEkAmG0j26M

    Score
    10/10
    qakbotbankerstealertrojan
    behavioral5behavioral6

    • Target

      ContractCopy.lnk

    • Size

      1KB

    • MD5

      c4a27e331d90565b9c5c41df4f8521c2

    • SHA1

      fd82da522c132784bd65848f5e782fc99ce9ccc5

    • SHA256

      c26d8122378f47949e55d83eed5de107e7a2d08b1a6b5826d185458fa6142309

    • SHA512

      9098dfd1c7c35c718b7697a754519d4ae2e7311a4790fbaba6e7395f24abf3a6a9e6d5c7d593034cf75022534566c99f4695c65db4c89df2e457048e446404d8

    Score
    10/10
    qakbotbankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral7behavioral8

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks