Overview

overview

10

Static

static

Cancellati...6.html

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cancellation_6586.html

  • Size

    942KB

  • Sample

    221027-fkt1bsage4

  • MD5

    1c56c4aec3e54d30fa63483a17466205

  • SHA1

    0fa71aec205b68951153bc0f5bde462112b8d003

  • SHA256

    49368ec77377b78f97e5e0cc336f36a06b10e3ba1c4639254d0f0e6e0fb81b6d

  • SHA512

    182af3835d7b7ab5849185548e721cdde9f3c9c6e1e7d786ca8c42204084bdaa2d6f7dd9d974542ddb4f09960013ffcc43a9009e22e4ae75290e846419084a63

  • SSDEEP

    12288:rCHcTysdzqIjreO8rAP6mKIXSKlnv4fnaiJEvSqnyKY+zAUpjKOJezIS0tLRVe:rRyskirb8lmdSYofJ+ms7RRVe

Score
10/10
qakbotobama2171666765529bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

C2

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Cancellation_6586.html

    • Size

      942KB

    • MD5

      1c56c4aec3e54d30fa63483a17466205

    • SHA1

      0fa71aec205b68951153bc0f5bde462112b8d003

    • SHA256

      49368ec77377b78f97e5e0cc336f36a06b10e3ba1c4639254d0f0e6e0fb81b6d

    • SHA512

      182af3835d7b7ab5849185548e721cdde9f3c9c6e1e7d786ca8c42204084bdaa2d6f7dd9d974542ddb4f09960013ffcc43a9009e22e4ae75290e846419084a63

    • SSDEEP

      12288:rCHcTysdzqIjreO8rAP6mKIXSKlnv4fnaiJEvSqnyKY+zAUpjKOJezIS0tLRVe:rRyskirb8lmdSYofJ+ms7RRVe

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks