Overview

overview

10

Static

static

Cancellation.lnk

windows7-x64

10

Cancellation.lnk

windows10-1703-x64

10

inexhausti...on.dll

windows7-x64

10

inexhausti...on.dll

windows10-1703-x64

10

inexhausti...es.cmd

windows7-x64

1

inexhausti...es.cmd

windows10-1703-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cancellation#4371.iso

  • Size

    1.1MB

  • Sample

    221027-ay13xaabf8

  • MD5

    4a8ecccbd8625eb3de8ea93f966d0f13

  • SHA1

    86c060d9947f3469da5e2e4fd60360889008bc4e

  • SHA256

    b2068579e8a80f25c6a0e74692ef4488cdc08a06f85f2eec3fb1b05c313071e1

  • SHA512

    d6e76c9c387bf0e316197e79fbf9ecfa9c4f72afc857a61647661988b01efa26559bcd3514dd930f84127d7cc8cb8a3b342f86143292957d178e7dcf7015a326

  • SSDEEP

    24576:THHWHgHHMw0wywOw0wJHwAHy2w9xwUw0HSwVwHJGcs/TwmCdhZtZQefT+K:THHWHgHHMw0wywOw0wJHwAHy2w9xwUw7

Score
10/10
qakbotobama2171666765529bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

C2

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Cancellation.lnk

    • Size

      1KB

    • MD5

      9036b5af82bb0a71c1c3d95430611eff

    • SHA1

      fb099ea73fb5f1b199ff3e52d46afcaaa717c580

    • SHA256

      27116c1d5025750fd133cc2bef6d10dfd3b1758ca61cdf5df5d4d9aaab5c0b8e

    • SHA512

      3bcbeec6e69b0337478aae9e4a56a326231547c793b00da88db19b6894648e01ec229a6f9f2d2e87d93f7f87e305d48b140b33f633f8ed128f01c9957e6a9f6b

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      inexhaustive/pretension.dat

    • Size

      420KB

    • MD5

      dcbbc163ae790031432d9ca7c769440c

    • SHA1

      66719c0e7a91220d8e21fef7a6afc7221526aa4e

    • SHA256

      d54e74f46f33f2309110d551147a374c005c8f48865dbcdd83f1a8d5a527d408

    • SHA512

      56d091f6275ac4b04c2c31866da870ba3bcf131fba329829b4479fa8a8b5c9ec5bbc000923c59927ac10ee6c175d4e37b973590ed2b1094da4e3e8dc2b297b23

    • SSDEEP

      6144:5MVSKlGqB/JXPX+cLBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWcRkq/GNU1E1T5Hb1

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan
    behavioral3behavioral4

    • Target

      inexhaustive/techniques.cmd

    • Size

      330B

    • MD5

      e7a438d4d05ec048e784b978d63047d5

    • SHA1

      a5723f0cf26cfe9b9925348396b7074c587e19f4

    • SHA256

      56c0e16d606461e0779c0fcb5007a9e127e14d2d98504226baf438770961e050

    • SHA512

      03a7f8f89b7f5840342e193e7c99df9dd3282b1f02c126fa75259cd611e9423a34ed80775cd9beaae14dba42e5dceeebd2fb99ac1c715ae905d659f446f35255

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks