Overview

overview

10

Static

static

Cancellation.lnk

windows7-x64

10

Cancellation.lnk

windows10-2004-x64

10

inexhausti...on.cmd

windows7-x64

1

inexhausti...on.cmd

windows10-2004-x64

1

inexhausti...ng.dll

windows7-x64

10

inexhausti...ng.dll

windows10-2004-x64

10

Resubmissions

27-10-2022 20:48

221027-zlxbmadfbj 10

26-10-2022 21:05

221026-zxgqbahah4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cancellation_6411.iso.zip

  • Size

    468KB

  • Sample

    221027-zlxbmadfbj

  • MD5

    a8df0c876ff53501c664a3c9881ee284

  • SHA1

    0d61b040fdaa5a1dd16295e676a6c9fb6cabf317

  • SHA256

    8cdfe097794d569755c1af8345043acc95c1132117587b967fd5fba9251667e0

  • SHA512

    c0e9553bda4acd304956b9c82e9e1f7c83a82fb57a32ac65142848a0c2531e724896de7ce9f267e3f1ad033bf1f3551d949dd0cddda5d376a12b5b0f6450f0f9

  • SSDEEP

    12288:/Wui6GGYy/dtWAUD2reonbxySLMiODpjae0Wop6uNkdQm:uu8LRDFGxhZcpg6SK

Score
10/10
qakbotobama2171666765529bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

C2

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Cancellation.lnk

    • Size

      1KB

    • MD5

      d8c1cda53109474dbc1a19edf2d459dc

    • SHA1

      f42fb72598e14ebec95fd75a1306c44dc4cf2168

    • SHA256

      123cf8f0f2168f6b16389216a7ac9d49434d952d94162908634ef40e4051d698

    • SHA512

      d8cd5862eb9ba0904fbcc201075e495624d7b74c9a8f887a5555e01e697378b898a847974ba7cc087096f488c877923b08a8e1377d8ffebc09fb86377b036f11

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      inexhaustive/combustion.cmd

    • Size

      321B

    • MD5

      ceadb773612a337d0fd3b8b98c7f5bb6

    • SHA1

      819cd8a0065f47068fe10d884aa37007d710b3b8

    • SHA256

      905eb175025de53a2064cd75519af92459a38ea72255273f9eb196a8b8607fdd

    • SHA512

      9e149dc744689757dca9ad34d9541cfbec915ee2573b2698aca7912e0c3c8f97774a52c6ccfdfe059c516473bc2f06aa82552d519b612fa2fc0c30afec3c3413

    Score
    1/10
    behavioral3behavioral4

    • Target

      inexhaustive/depredating.dat

    • Size

      420KB

    • MD5

      313067ea30fd57e0fb1135e12b4aad45

    • SHA1

      abb237b54a6b055d8f97f8b60590dabda493af60

    • SHA256

      3c5880ea4b0ee48001c6e05a5e115e0f3ec6394f1e7cc2c1572f564d1140d17c

    • SHA512

      68a40fe075c802c2fc73085cc9a672aeccea22faeb24c37c62b7b8aaef4e8ed4dcff9113284d613406dad78ec07c85c09bed6dcd28116d5f918829d0b48f829f

    • SSDEEP

      6144:5MVSKlGqB/JXPX+cZBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWcrkq/GNU1E1T5Hb1

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Drops file in System32 directory

    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks