Overview

overview

10

Static

static

Cancellation#9860.iso

windows10-2004-x64

3

Cancellation.lnk

windows10-2004-x64

10

inexhausti...ed.cmd

windows10-2004-x64

1

inexhausti...rt.dll

windows10-2004-x64

10

inexhausti...nd.txt

windows10-2004-x64

1

inexhausti...ee.txt

windows10-2004-x64

1

inexhausti...ss.jpg

windows10-2004-x64

3

Resubmissions

26-10-2022 21:55

221026-1stprahccq 10

26-10-2022 21:52

221026-1rkepahcb5 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cancellation#9860.iso

  • Size

    1.1MB

  • Sample

    221026-1stprahccq

  • MD5

    56f40f4ff403f5e93daede7f65763aab

  • SHA1

    3bc33675de26e9dd336ea9b8181ef0db7fd93f13

  • SHA256

    8664cc0492e319baa8ef51a3233a7173cb25a7deb00af4dfd2e4b4b38a48990b

  • SHA512

    913e62b18c6021d4e76658b5744b2589e8635033afc40b2c7517e504a69fc40c9338ec6edf7843f4bc3b3d14dedbedaf992b5c6b5c027226495a0b414d37614d

  • SSDEEP

    24576:/JGc0/THHWHgHHMw0wywOw0wJHwAHy2w9xwUw0HSwVwlwmCdhZtZQefT+K:DUTHHWHgHHMw0wywOw0wJHwAHy2w9xwk

Score
10/10
qakbotobama2171666765529bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

C2

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Cancellation#9860.iso

    • Size

      1.1MB

    • MD5

      56f40f4ff403f5e93daede7f65763aab

    • SHA1

      3bc33675de26e9dd336ea9b8181ef0db7fd93f13

    • SHA256

      8664cc0492e319baa8ef51a3233a7173cb25a7deb00af4dfd2e4b4b38a48990b

    • SHA512

      913e62b18c6021d4e76658b5744b2589e8635033afc40b2c7517e504a69fc40c9338ec6edf7843f4bc3b3d14dedbedaf992b5c6b5c027226495a0b414d37614d

    • SSDEEP

      24576:/JGc0/THHWHgHHMw0wywOw0wJHwAHy2w9xwUw0HSwVwlwmCdhZtZQefT+K:DUTHHWHgHHMw0wywOw0wJHwAHy2w9xwk

    Score
    3/10
    behavioral1

    • Target

      Cancellation.lnk

    • Size

      1KB

    • MD5

      4c4f8d9e299bea165e6919733b0ec3a7

    • SHA1

      795ebfb6c1ae92d7bc4b0c5d0d5e71feed62d610

    • SHA256

      18a43d3c96f335c36bf0c9743151b8bd31648f324aadde085fb5dc4b43c342e1

    • SHA512

      a66b445994b9378748dd442e52a4d3daf791624115a80e646708b01b2e652596af191f003cb2f9dc7593e9a496378014c4754e10d60ba0bd55bbce63f8939ffe

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral2

    • Target

      inexhaustive/caged.cmd

    • Size

      302B

    • MD5

      36b77bdd5eabd34d95d105d692e5779d

    • SHA1

      f3a96469ba6d3919e8f2669a865c29653c3e183c

    • SHA256

      d9d5509cde3c962af4cdf5d6827779ef8d33902d83468d6bedb75c6121a8270a

    • SHA512

      90a7265aee7febf08f641da8e27b6e6acf51eebc509ab8b7cfa7b29ee961a0afa0dc4980f2f853175fa741e4d3c2cee5c03a962ac6a643f2e60e897b1d065579

    Score
    1/10
    behavioral3

    • Target

      inexhaustive/consort.dat

    • Size

      420KB

    • MD5

      a6926d24cfbe649f577bb46b75627111

    • SHA1

      aa0a014ff71263241fa42c6c2eb433eebd57ddcd

    • SHA256

      d3ba7bfab00fc60fa37454316f0bbc978c15505d14b1eb616e4277a04411abbd

    • SHA512

      7e1570962ba4390170de03e24937ead69754cb030115141b3e4a51284a8ff0a48ecc1287dfde7a9bfea8e06b79c881d2e6cf0c9929b60e1cba1249432ebf15ff

    • SSDEEP

      6144:5MVSKlGqB/JXPX+cDBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWcJkq/GNU1E1T5Hb1

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan
    behavioral4

    • Target

      inexhaustive/havilland.txt

    • Size

      258KB

    • MD5

      3afb433747c0a308d1376f2bf7abe2af

    • SHA1

      fd32e023fe97e0b4041b2fd74b4b45482339a36c

    • SHA256

      c6ddeb62e9089d383f0f52b44ec9d1e2ab8b473b058ea3dce2071d03064ab925

    • SHA512

      23f9ecf9f5f107ad8677ea96a005fd1a2eb8ba590fa8acbc0f941ea5b18a68148f9fc53bd7824f0c8a8f990e17af870bd3502a54f91acb0415e694e461f50bdf

    • SSDEEP

      6144:OOTOHHHWHgHHuxwWnwEnwOwdS6SJwJHwYOCHyXrOBXHnw9xw2nwnOlHLu9wMO092:OOTOHHHWHgHHMw0wywOw0wJHwYOCHybf

    Score
    1/10
    behavioral5

    • Target

      inexhaustive/tutee.txt

    • Size

      281KB

    • MD5

      e131110f0aa9bc4339beb8d6e7a44e68

    • SHA1

      20f4230b1d0ad36b5eee37f5087d5cba2c62351e

    • SHA256

      cbca00ba9cb9342bca43d39ce121852e4bcdadc9d8085582c3c961fbefb23dac

    • SHA512

      aaae658739c4b867f1d028aa4b27837f0d25c4bd709c0b4c0f8f620b1286eebe6a3d63387f35fd2ace460c57c1d0c59ca8709e1258565e8fcc89db00074803f0

    • SSDEEP

      6144:+bVGX0w4O+UXNVlD0C3iW5hWXJhbp3NhbVdEXNYLXplD2bsytWkGMxvlDZMbPoah:8wmCdhZtZQem

    Score
    1/10
    behavioral6

    • Target

      inexhaustive/waviness.jpg

    • Size

      61KB

    • MD5

      980e8d60a93e3fa912d4daffea779480

    • SHA1

      b329eb8d42f798dcdd216d32654d90a3dc48385a

    • SHA256

      98d87b782bf26c21c0c8ad62e402d0475e1f22fba96f02453d994b643b5be174

    • SHA512

      a34bdd17ede8f6cc0701bae9064832e095e768a7ecf652218539de666d4443720585af57a55507bf9a6878d0752a6803980c0dc1741d7b2b079bd94da3e0b051

    • SSDEEP

      1536:222UdBqBD/jJ+d7naXHqmljv86xsqeyB9mPg6gopzGIAF:n2UdBqBTtqGqiQ6xss3mPbgoJ8F

    Score
    3/10
    behavioral7

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks