Overview

overview

10

Static

static

Cancellation.lnk

windows10-1703-x64

10

inexhausti...il.dll

windows10-1703-x64

10

inexhausti...ng.cmd

windows10-1703-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cancellation#2190.iso

  • Size

    1.1MB

  • Sample

    221028-jcmstsehd6

  • MD5

    86cc3036da9c830abc0839b7af665b8c

  • SHA1

    ebf2746ff48531e62b0fb690c8569ae0d6a07dbf

  • SHA256

    40ac8d0d0a0ec5f73c627972989502699c5fb0254387187ba46aaf4e13bbbacf

  • SHA512

    f181ad6fd5f89be3ed26cc7e23ee0dd9bf1560ea4e362ace99da11493a191d10bac6cef4b46211da17a9b53284c467b71d572c7b0819db11e550daabefce4ab3

  • SSDEEP

    24576:oJGcE/THHWHgHHMw0wywOw0wJHwAHy2w9xwUw0HSwVwswmCdhZtZQefT+K:yETHHWHgHHMw0wywOw0wJHwAHy2w9xw7

Score
10/10
qakbotobama2171666765529bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

C2

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Cancellation.lnk

    • Size

      1KB

    • MD5

      267f63c6102af83c62c5770796f0f45b

    • SHA1

      ef65aeedfe61fb019819eb831e7a16d501631269

    • SHA256

      0a1abce71147017fac0949221c78323f84a6cfbdbb5d85df08e844b329df00f9

    • SHA512

      9c2c7efa076073757d0539b79c81f10a1e1c3df5869f5414aa9427de92795df1e65756484817d703271a6b2ad87ed8c09c14d2e17bf62a8a2a02089479e0f08e

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan
    behavioral1

    • Target

      inexhaustive/airmail.dat

    • Size

      420KB

    • MD5

      2b107a1b2555573580c4032a518ac17d

    • SHA1

      abae0243f574ab74948821935f9bf7d6dcb64a27

    • SHA256

      b1aa766d61261a82a3dea72bd67448d64bcbbdaafeb5be2a3f8dbd4b66e5c10c

    • SHA512

      daeefe3fefa51b71226fbc786ba423f5fcca231966dc1622ed7bc4e679d80386905d54c7dea8298822ce6c6458361219b9000931a87673448c975a1f6f40398f

    • SSDEEP

      6144:5MVSKlGqB/JXPX+cTBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWc5kq/GNU1E1T5Hb1

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan
    behavioral2

    • Target

      inexhaustive/punctuating.cmd

    • Size

      304B

    • MD5

      1307c8a8a0a21c6c056c28d1bd61e8ba

    • SHA1

      011ef265f31f178d8e560b049a5d003abf1535c0

    • SHA256

      0be46924730d4009cfd98bebaedfeef3316f6303376ceb93a20497b6452b4d5a

    • SHA512

      c6aa20650a695f72b10f2316945f543fdf03c1c601000d84322daaddb8730b14fe46f3b05a47d6a1279e74746d6689a395982439d7e43bb3a091fd019a65512d

    Score
    1/10
    behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks