Overview

overview

10

Static

static

Cancellation.lnk

windows7-x64

10

Cancellation.lnk

windows10-1703-x64

10

inexhausti...cs.cmd

windows7-x64

1

inexhausti...cs.cmd

windows10-1703-x64

1

inexhausti...ss.dll

windows7-x64

10

inexhausti...ss.dll

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cancellation#3694.iso

  • Size

    1.1MB

  • Sample

    221030-xxgzzafag9

  • MD5

    9a551b5926745cd22db3cc41e2318d10

  • SHA1

    cf5d50432f145554a1eaebf781d15184779a731f

  • SHA256

    85d0b5b95ccb9e5657ffd7d1b324083bfc7bc76b8e21ba222e62a98b2dd4ae70

  • SHA512

    4b4f2059524d0ceeb1464258e58da812f6c3b138b0cdeb4493dc2ecdd39ec729d73051aa48edec9ad81df74e4f75e4cdaf69c4c7785080f7e23f5cb2a2bd199a

  • SSDEEP

    24576:fHHWHgHHMw0wywOw0wJHwAHy2w9xwUw0HSwVwHJGcs/LwmCdhZtZQefT+K:fHHWHgHHMw0wywOw0wJHwAHy2w9xwUwP

Score
10/10
qakbotobama2171666765529bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

C2

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Cancellation.lnk

    • Size

      1KB

    • MD5

      efcc58bee0b08689677b19d414a6a7cc

    • SHA1

      ef042078f0a1168d95384e3f62025e33a3951c7d

    • SHA256

      456c39c59ac5544a98b7d274c5f42fe5c66a75b04d8e0c2d648be3073c790f71

    • SHA512

      df28622e4a197022d2a2501aca211e6d707858e2c49aeaf34b2552f040456d1e2e578b1ad30db6f574e922fa4a1ff62738ecab00313b74d76f6711b2a7fde59d

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      inexhaustive/automatics.cmd

    • Size

      324B

    • MD5

      16bb4db0fa47870642d7fc1099f2a2d8

    • SHA1

      dfdb70a0d13bc6327688cc4054ba99d659ab9395

    • SHA256

      84ed5a6ee799919034fb88fe2a995a0f5cd76735d130a5393ffdfcf88fbf851c

    • SHA512

      2eaa0437f3d605c42e6756fa55f4668b19c793d336032696a8f570a204e7bf310ff7cf8ddbea5668e87790057c84953a52172265d14cf9bbe7d46a65d5ce1f97

    Score
    1/10
    behavioral3behavioral4

    • Target

      inexhaustive/illustriousness.dat

    • Size

      420KB

    • MD5

      dd81abd364fd77a34d406fb209ef37ff

    • SHA1

      4a6d6c9348cb3e77ed2d5195833f437b7c2f08d2

    • SHA256

      22c6e84683cba9e8bfffc7453a33fbf7611e9c6c48f5fb088f0a21912c2b23a0

    • SHA512

      11027ac2c89ebb053b648b5bed6019bc7716e0ce7073071da6e32046a08a6a744f40f325a23a096ace6af06821413395f073c32030aab4842e0af1c0dd9d32fc

    • SSDEEP

      6144:5MVSKlGqB/JXPX+cLBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWcRkq/GNU1E1T5Hb1

    Score
    10/10
    qakbotobama2171666765529bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks