Overview

overview

10

Static

static

Cancellation.lnk

windows7-x64

10

Cancellation.lnk

windows10-2004-x64

10

inexhausti...zy.cmd

windows7-x64

1

inexhausti...zy.cmd

windows10-2004-x64

1

inexhausti...ss.dll

windows7-x64

10

inexhausti...ss.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cancellation#8782.iso

  • Size

    1.1MB

  • Sample

    221026-xs71lagfh2

  • MD5

    0968826f48debcfd510cda1cf8c7bef3

  • SHA1

    4c3a7078e153146f063824394163132e7b52c9d6

  • SHA256

    5d8b65a9b8f35388d8cf93c0431dea62a644b437242109e4d40a618ed58edfdc

  • SHA512

    9b0d0d7374306252cdcbe70ec81d142de434d857a2aec150531a38656cf30512b08db0c03c1b01f4a9d811a796b1bf40c2836f4baac92d116319fba00d4ea296

  • SSDEEP

    24576:1HHWHgHHMw0wywOw0wJHwAHy2w9xwUw0HSwVwHJGcK/LwmCdhZtZQefT+K:1HHWHgHHMw0wywOw0wJHwAHy2w9xwUwx

Score
10/10
qakbotobama2171666765529bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

C2

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Cancellation.lnk

    • Size

      1KB

    • MD5

      f934c3e7539f359d779aa3fb82272d1a

    • SHA1

      ad1781918339d5e59cc67bf86f9aff329de53c4d

    • SHA256

      5c922ef8bd5690f45f27bcf8a6fba05d5a6d89db39deb4b69237d9ead14e724b

    • SHA512

      a960c2b516f4bddb54dce77bacbc9920b645ba61aeb9841e510dc43bee198834a3a87e622540fb39d6f42791487949a415f62f145e2e7157e703c275e5e17fd8

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      inexhaustive/dizzy.cmd

    • Size

      319B

    • MD5

      83310df9c875749cc479c04acbb85898

    • SHA1

      0e16c2256da74670c02561e26c6c7103d15eb06e

    • SHA256

      8e530e70992638583d35864d3d6309e33db90c7036efbdddc4b2e5d37e939a0b

    • SHA512

      eb934f0e85a332606d603ed18d468e330475366c5dbacbcd93069b524586acb4e05219f064b90d3faf987d326fda991c77597072b1689c5fb1020d5fbab01765

    Score
    1/10
    behavioral3behavioral4

    • Target

      inexhaustive/snugness.dat

    • Size

      420KB

    • MD5

      5f564db88f499a2e943b819f366bc02f

    • SHA1

      dbde137a288648ca4e55529384666d565c9e7004

    • SHA256

      91bd47bc55fc258b74303067c506b578ecb57d0c709aea354d83c83391e3925d

    • SHA512

      d97c50e893bf10f38e907173120adc91be07e0179b2b9bc3bf05ac4aad28de366139822d02a9dc033d1d61b68c07307505fff26cb4618fbfa005187f68d9ce66

    • SSDEEP

      6144:5MVSKlGqB/JXPX+cVBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWcfkq/GNU1E1T5Hb1

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks