Overview

overview

10

Static

static

Cancellation.lnk

windows7-x64

10

Cancellation.lnk

windows10-2004-x64

10

inexhausti...es.dll

windows7-x64

10

inexhausti...es.dll

windows10-2004-x64

10

inexhausti...ng.cmd

windows7-x64

1

inexhausti...ng.cmd

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    78377ec9-5d59-48ff-9235-52fbc07e5a33.zip

  • Size

    467KB

  • Sample

    221028-w1dw2saeep

  • MD5

    425c0ae285d0973445ba8d62610f6e06

  • SHA1

    04bf516c5f2e9de2ad0ada6c5e00281cdf089c40

  • SHA256

    055cb3dbcc956ca69a885653876dac6927c84687e826f5555e48609c588228cc

  • SHA512

    30a1163ae7c692fc83f4916e4868dcc2580c01a291180eba7305426c2be4ce7e3babaa8e666c38bd9c62f318cf14e6aa54b9325cd80c931475ead85b45764f22

  • SSDEEP

    6144:vZct6P7S4/fEJF65E700CCzDFpeZ7VojpVcwe7NS07Y4kDRE9Nt44vxeY4xxR:vZct6Pm4XEJF65q1gu6bUnANt44vx4R

Score
10/10
qakbotobama2171666765529bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

C2

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Cancellation.lnk

    • Size

      1KB

    • MD5

      db8d8335ab6bb5334d4a392152732273

    • SHA1

      b661c0ac22b72ae79521aa1495474972b75ee9be

    • SHA256

      2eac63cb5df6d41e3cd26787195cc1a426d6ab3a9a44eb9ce9969a70404753e2

    • SHA512

      eff6b233609154b2a94ce3ca2631861e3b5db2035e9513dfe84e54d1591894079ee29e5d8c9793d7bce75e5e3403f87a05d96121e85fc18a8172adbcba6b8280

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      inexhaustive/dehydrates.dat

    • Size

      420KB

    • MD5

      99fd3e8feaf48e111b0fe8ebec6d55ec

    • SHA1

      3eb843af45c37197eaaebddba7de2dec62b564b6

    • SHA256

      48ab43796e6c498055627eaf05241c718c7e6a59b55086eee5114dd8c5d19053

    • SHA512

      6a185ad24fc60e014ec5d7fc09dd3ec34974895dbed0928ad1bb4757f337d548b5227a046fe284d18ea8eb0822613e85853bc4171018783aab6da3a05cf2331e

    • SSDEEP

      6144:5MVSKlGqB/JXPX+cUBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWcIkq/GNU1E1T5Hb1

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan
    behavioral3behavioral4

    • Target

      inexhaustive/flabbergasting.cmd

    • Size

      310B

    • MD5

      50159281f514b55c8da442e3a4f0014b

    • SHA1

      7204ea324d279bd170b5551269c1e12d53863428

    • SHA256

      d95dcaf21aa95724fc9158cc853b4282b2cddd5d55af617ebcb9d6252014a290

    • SHA512

      58220038f922f95093c3e1be2ccd884a17a73cfbd8467de970152df211260c778cf029666f1d6c895497c75db10a6352dab9fd9f5012d170cfc4bad83eb2c9fb

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks