Extracted

• • Target
    A3236.iso
  • Size 746KB
  • SHA256 dd598cdbb9f24f509ea03074365a44889ed5ec1cf5ecfb256b1cf1b804d9305f
  • MD5 6fffb195c848b0ed0286d7f7ff662a20
  • SHA1 c3b59a099236097084ea3ac8b89c8f8b135d721b
  • SHA512 705f32c8a070a3a71a1cc12112c6a918d01d89cf7cecba55055643748cb1d1ae628a0930929f64f2c45e29cb532dc2c63274ddda794546fdbbd18f273fd2d16e
  • SSDEEP 12288:QaTUuJV6YFbBiQdHeJnehGoidM6frAGxx5ueHy0fJ5gsy:QEUsbM3NM+57Hy0fJ5gsy
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral1behavioral2
• • Target
    A.lnk
  • Size 1KB
  • SHA256 6c1cab0b6d5bfe59e552b03b0dd8954fe60a9f8b90075bf1213f54a87102ae77
  • MD5 4e8f5a677147bede90cc610d1865bc4c
  • SHA1 9b3fa14d20ca39dd7151d8a9c66e2d562370cc28
  • SHA512 ad7e5797bd752bb77f395fbf181526146bb1d53ff7b844b87093bc763e348fc795b2d557982fa8a8cfbca71b27046ebae28384096ca4df4c0a9f263c3440fe4c
  • MD5 SHA1 SHA512

  Score

  10^/10

  qakbotbb041666776460bankerstealertrojan

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral3behavioral4
• • Target
    tools/downhill.dat
  • Size 420KB
  • SHA256 59b972ee78d2df56f55f1f9e786c07b604014480ec5a7f1c61a702c7b1b4a8f8
  • MD5 2129c7bb21aa6185a8902282e9764c83
  • SHA1 7a0fa4df0970e1f04da9ead232d072d12080211e
  • SHA512 3e719ef4c89a451bb4b95653cc7b1508db6df1c4d9da1484876ece2651338bbeec6fbb51054fb0861eabc19aa71c686a24eccdc28887ac060d5d7e7d1220c38e
  • SSDEEP 6144:eaoqvfUuG0D12UVh4whFLpxBiQddwL4UsjewMJlEXk0DGKVjL3OehGubH+bhBrM+:eaTUuJV6YFbBiQdHeJnehGoidM6fr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  qakbotbb041666776460bankerstealertrojan

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  behavioral5behavioral6
• • Target
    tools/merlin.jpg
  • Size 37KB
  • SHA256 8cefcf11dd4388fcb6420417eb53a6b5fb5b3e0757f00a45888cc5f041eb7a61
  • MD5 963e15589f18ba8c2769b4e5b2bfca13
  • SHA1 85e9066faf4ca36da625928cec2bb2244ff44ef1
  • SHA512 cac64ccd8693cb557f1517a3ac0c96f56f9130b6bf7cdb60e728063249ec9bf2055b119e3e041a1b9f7db0c04bcf17d2bec9be8ecba826275a672b9879f4efca
  • SSDEEP 768:LOVGGJD/Kx85QpMxu9LURbNe/OyaC9qjf9ZmL1oEo3TMicg3+9:aVGG1Cx8apslRbNbyHMjf9ZmBoEoQb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral7behavioral8
• • Target
    tools/nekton.cmd
  • Size 543B
  • SHA256 2bd66865f54a0951daa171cd946f88851377f0c07e4f782cdc9c1e0a76676c64
  • MD5 dfa4cb922f26b99f3df1b43d2d65c8b6
  • SHA1 d2294259d6d1775451da3333f71fa19bffd01fca
  • SHA512 7a4339ff6f0e6d043b258c16576c4f6d56fbdef988d7db70432225fbe257dede060a9dba0004656c2833ac6439b3537dfbb865899b233c9beb53da297d8d45d0
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral9behavioral10
• • Target
    tools/pops.txt
  • Size 225KB
  • SHA256 9aae3f76b9abc43934571b6b5e13cafc6142a6f086ba4fb8965e127f469b0d1a
  • MD5 8001db9a5260964f3c2b19487738692d
  • SHA1 67395c472aab6e72c373728fa73ecba2fee1146e
  • SHA512 af4d0e622fd1db40c3fc6d9fe6f2ee50eddc891f082ca35614cd5163a5c2734f25fcaf38e89fa0bd618130266556a54d01ad0a865cf1442e10cad777ba31f514
  • SSDEEP 6144:M5p+lDj4lo/S1xrfyWGX1O/QxlDtwFXuX49aoMbc6XKlDbc/05u1Wi+lDmlD5blU:MHy0fJ5gsyE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral11behavioral12