Overview

overview

10

Static

static

CVME53.iso

windows7-x64

3

CVME53.iso

windows10-2004-x64

3

CV.vbs

windows7-x64

10

CV.vbs

windows10-2004-x64

10

inducted/torsos.dll

windows7-x64

10

inducted/torsos.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CVME53.img

  • Size

    722KB

  • Sample

    221115-z1tt2sfh89

  • MD5

    b542f69086c13c44a33f760f832f36cb

  • SHA1

    47b2a4934981a26b3709d1f40c612319a5b5c95d

  • SHA256

    bfedb29892cdc420c9022d615aa1fb5a3cc78687702b682213d0ff7f220f0699

  • SHA512

    91b5bc401b62353a6f0f617ad6b810a7b063fec84c84e280247b008d6a80e91a38a7bd2af4a2d456543f44b92109c6feb720895a8efd901649e4bdd12f90a7b2

  • SSDEEP

    12288:LYIq/TGcg+w9KCOJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:LYIq/TGckKCO30IAIQR3O7OjHHAp

Score
10/10
qakbotbb061668492308bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

BB06

Campaign

1668492308

C2

49.175.72.56:443

81.229.117.95:2222

47.41.154.250:443

69.133.162.35:443

84.35.26.14:995

68.47.128.161:443

156.217.219.147:995

87.65.160.87:995

174.101.111.4:443

82.127.174.33:2222

91.169.12.198:32100

24.28.121.122:443

157.231.42.190:995

90.89.95.158:2222

74.33.84.227:443

24.64.114.59:2222

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

170.253.25.35:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      CVME53.img

    • Size

      722KB

    • MD5

      b542f69086c13c44a33f760f832f36cb

    • SHA1

      47b2a4934981a26b3709d1f40c612319a5b5c95d

    • SHA256

      bfedb29892cdc420c9022d615aa1fb5a3cc78687702b682213d0ff7f220f0699

    • SHA512

      91b5bc401b62353a6f0f617ad6b810a7b063fec84c84e280247b008d6a80e91a38a7bd2af4a2d456543f44b92109c6feb720895a8efd901649e4bdd12f90a7b2

    • SSDEEP

      12288:LYIq/TGcg+w9KCOJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:LYIq/TGckKCO30IAIQR3O7OjHHAp

    Score
    3/10
    behavioral1behavioral2

    • Target

      CV.vbs

    • Size

      9KB

    • MD5

      7dd861d05548fbaff47450da82e2133e

    • SHA1

      84ef7cbf7f44b130bc451e772c1db0ab57f26ece

    • SHA256

      a26f5828e05877db84769b8607fd1b8f2cc7ac55ac4f28e7dfab2a600cae493b

    • SHA512

      6bef54698669cb1455d02acd0be332ed3a289e1ac710c845d5ebfdc32a06b46ba97b0f9b7980a1e71a69804f8d12e63d2804b66b460d1306b1d06285b0c72669

    • SSDEEP

      192:mEWJeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:H341ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      inducted/torsos.tmp

    • Size

      624KB

    • MD5

      11c635f5119cef4f6e3f0e6c539cdbf0

    • SHA1

      0504733474326ab37d07556284c07214858e4bb5

    • SHA256

      67c3d495ef4c173f59d15dbd9e10f21247d1a70ec28f58139faf4a698b0f2992

    • SHA512

      1f4a5397a9581838d6e2dbb0ad6698f341cf6df415a7b8744d0cafe7510691a58ca437e2255f8d1d089f3a7ab40a10c39ad5bf75c839f4b415f369d05d31b3ae

    • SSDEEP

      12288:i/TGcg+w9KCOJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:i/TGckKCO30IAIQR3O7OjHHAp

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks