Overview

overview

10

Static

static

Cancellation#7827.iso

windows7-x64

3

Cancellation#7827.iso

windows10-2004-x64

3

Cancellation.lnk

windows7-x64

10

Cancellation.lnk

windows10-2004-x64

10

inexhausti...ke.dll

windows7-x64

10

inexhausti...ke.dll

windows10-2004-x64

10

inexhausti...nd.txt

windows7-x64

1

inexhausti...nd.txt

windows10-2004-x64

1

inexhausti...ks.cmd

windows7-x64

1

inexhausti...ks.cmd

windows10-2004-x64

1

inexhausti...ee.txt

windows7-x64

1

inexhausti...ee.txt

windows10-2004-x64

1

inexhausti...ss.jpg

windows7-x64

3

inexhausti...ss.jpg

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cancellation#7827.iso

  • Size

    1.1MB

  • Sample

    221026-w9ngvagfar

  • MD5

    3e9b6f395656c92c6f12aec1c6fc57ca

  • SHA1

    fda4d98ebb1841b63466443b1a713295acd491fa

  • SHA256

    e6440b4d1deed29d267cb294789e021e4196a5f82eaeb40c7ba0484de0af81d3

  • SHA512

    bd1d6c1c21188b6a3a3c2b0885806e986476a85e7b05587a7cfbadaeae392e78fb2b35daaf630906e7d8020bcf0b6379e09055d13a689c56c47b8575cc4d5869

  • SSDEEP

    24576:tJGcy/THHWHgHHMw0wywOw0wJHwAHy2w9xwUw0HSwVwtwmCdhZtZQefT+K:R6THHWHgHHMw0wywOw0wJHwAHy2w9xwE

Score
10/10
qakbotobama2171666765529bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

C2

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Cancellation#7827.iso

    • Size

      1.1MB

    • MD5

      3e9b6f395656c92c6f12aec1c6fc57ca

    • SHA1

      fda4d98ebb1841b63466443b1a713295acd491fa

    • SHA256

      e6440b4d1deed29d267cb294789e021e4196a5f82eaeb40c7ba0484de0af81d3

    • SHA512

      bd1d6c1c21188b6a3a3c2b0885806e986476a85e7b05587a7cfbadaeae392e78fb2b35daaf630906e7d8020bcf0b6379e09055d13a689c56c47b8575cc4d5869

    • SSDEEP

      24576:tJGcy/THHWHgHHMw0wywOw0wJHwAHy2w9xwUw0HSwVwtwmCdhZtZQefT+K:R6THHWHgHHMw0wywOw0wJHwAHy2w9xwE

    Score
    3/10
    behavioral1behavioral2

    • Target

      Cancellation.lnk

    • Size

      1KB

    • MD5

      bf33730a306c39feb6885c60dcd6bd3b

    • SHA1

      984bae24dc46f3e0fcef529ec1f256ffe174685d

    • SHA256

      ff10483715b8275b03e86dd9c3e2091ae79d9d5a9f2f8e5212d0b7c5e368abcb

    • SHA512

      c365afca389816639a437b836a40678b049ef0b533ca73f3d67cf1f315e4702c8fff12fef149dc161be8321945280b32dcd63e766f76f3def1ec0b7a8fbda264

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral3behavioral4

    • Target

      inexhaustive/fairylike.dat

    • Size

      420KB

    • MD5

      76e29b08210c6fcacba50652f9a4e55f

    • SHA1

      8c96da9eebfef256739accffa400ef8601b8c237

    • SHA256

      d1001e890a5ea40cb509330f098a0b3e24e2c03b395cbf5344a8f5e353b2b5b8

    • SHA512

      9544b70119b378e88a2f2700f45510dd87b3984aeaf466392c679daf885aa5d387f41eaa05e610b12042b694bbcf573d213dbb488467cf03be2d5701272c49e3

    • SSDEEP

      6144:5MVSKlGqB/JXPX+ctBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWc3kq/GNU1E1T5Hb1

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan
    behavioral5behavioral6

    • Target

      inexhaustive/havilland.txt

    • Size

      258KB

    • MD5

      3afb433747c0a308d1376f2bf7abe2af

    • SHA1

      fd32e023fe97e0b4041b2fd74b4b45482339a36c

    • SHA256

      c6ddeb62e9089d383f0f52b44ec9d1e2ab8b473b058ea3dce2071d03064ab925

    • SHA512

      23f9ecf9f5f107ad8677ea96a005fd1a2eb8ba590fa8acbc0f941ea5b18a68148f9fc53bd7824f0c8a8f990e17af870bd3502a54f91acb0415e694e461f50bdf

    • SSDEEP

      6144:OOTOHHHWHgHHuxwWnwEnwOwdS6SJwJHwYOCHyXrOBXHnw9xw2nwnOlHLu9wMO092:OOTOHHHWHgHHMw0wywOw0wJHwYOCHybf

    Score
    1/10
    behavioral7behavioral8

    • Target

      inexhaustive/stopcocks.cmd

    • Size

      336B

    • MD5

      0ce44103222d5332216b6c729c0378de

    • SHA1

      77a169b984fb60fdde6299a834f4e7db0b9a7e17

    • SHA256

      40e61038d8fd9c00088eb3e41434a06a410fb4c17c577b5c64b452d95d3f07f5

    • SHA512

      fd95f7972cbc024ec84da31227e6a728a8ec49329df119e92fa6429373c01c65478146d3731dfbd8ca386135c99f6e59992f6edb26efa9f6b0b53fd6b1701a0d

    Score
    1/10
    behavioral9behavioral10

    • Target

      inexhaustive/tutee.txt

    • Size

      281KB

    • MD5

      e131110f0aa9bc4339beb8d6e7a44e68

    • SHA1

      20f4230b1d0ad36b5eee37f5087d5cba2c62351e

    • SHA256

      cbca00ba9cb9342bca43d39ce121852e4bcdadc9d8085582c3c961fbefb23dac

    • SHA512

      aaae658739c4b867f1d028aa4b27837f0d25c4bd709c0b4c0f8f620b1286eebe6a3d63387f35fd2ace460c57c1d0c59ca8709e1258565e8fcc89db00074803f0

    • SSDEEP

      6144:+bVGX0w4O+UXNVlD0C3iW5hWXJhbp3NhbVdEXNYLXplD2bsytWkGMxvlDZMbPoah:8wmCdhZtZQem

    Score
    1/10
    behavioral11behavioral12

    • Target

      inexhaustive/waviness.jpg

    • Size

      61KB

    • MD5

      980e8d60a93e3fa912d4daffea779480

    • SHA1

      b329eb8d42f798dcdd216d32654d90a3dc48385a

    • SHA256

      98d87b782bf26c21c0c8ad62e402d0475e1f22fba96f02453d994b643b5be174

    • SHA512

      a34bdd17ede8f6cc0701bae9064832e095e768a7ecf652218539de666d4443720585af57a55507bf9a6878d0752a6803980c0dc1741d7b2b079bd94da3e0b051

    • SSDEEP

      1536:222UdBqBD/jJ+d7naXHqmljv86xsqeyB9mPg6gopzGIAF:n2UdBqBTtqGqiQ6xss3mPbgoJ8F

    Score
    3/10
    behavioral13behavioral14

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks