Overview

overview

10

Static

static

CVIM20.iso

windows7-x64

3

CVIM20.iso

windows10-2004-x64

3

CV.vbs

windows7-x64

10

CV.vbs

windows10-2004-x64

10

inducted/dacha.dll

windows7-x64

10

inducted/dacha.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CVIM20.img

  • Size

    722KB

  • Sample

    221115-zgdnqabf3x

  • MD5

    16bb685de34f4b20da290acbbd95ae20

  • SHA1

    1440da1e5f09301e336b02a17a25363589c09481

  • SHA256

    e716752ad3f7040eb9e930d8289dfafac109fbb180096950bcf2a1791afbe0dd

  • SHA512

    9eef0a83cfa95e4557f5300ec2d0dd7a69d43e9392a4a7c4cc39efb3561de1a2a50bd6ff4f3699f3127139c95cd7de655f9aa40183b84746673e9b4b11b21182

  • SSDEEP

    12288:XYH/TGcg+w9KC1JdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:XYH/TGckKC130IAIQR3O7OjHHApc

Score
10/10
qakbotbb061668492308bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

BB06

Campaign

1668492308

C2

49.175.72.56:443

81.229.117.95:2222

47.41.154.250:443

69.133.162.35:443

84.35.26.14:995

68.47.128.161:443

156.217.219.147:995

87.65.160.87:995

174.101.111.4:443

82.127.174.33:2222

91.169.12.198:32100

24.28.121.122:443

157.231.42.190:995

90.89.95.158:2222

74.33.84.227:443

24.64.114.59:2222

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

170.253.25.35:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      CVIM20.img

    • Size

      722KB

    • MD5

      16bb685de34f4b20da290acbbd95ae20

    • SHA1

      1440da1e5f09301e336b02a17a25363589c09481

    • SHA256

      e716752ad3f7040eb9e930d8289dfafac109fbb180096950bcf2a1791afbe0dd

    • SHA512

      9eef0a83cfa95e4557f5300ec2d0dd7a69d43e9392a4a7c4cc39efb3561de1a2a50bd6ff4f3699f3127139c95cd7de655f9aa40183b84746673e9b4b11b21182

    • SSDEEP

      12288:XYH/TGcg+w9KC1JdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:XYH/TGckKC130IAIQR3O7OjHHApc

    Score
    3/10
    behavioral1behavioral2

    • Target

      CV.vbs

    • Size

      9KB

    • MD5

      69d9763829d6a475d6724beaf9881a9c

    • SHA1

      042a944976e5ad0bca24e59cd6fa439fcbaca8a1

    • SHA256

      b067f67c2d2bf706d870c2b9596fd40a67191e101d736e2447e32bc4426ec7d6

    • SHA512

      4c1d45284bc294a868eb2261506af60820786def3a77a27ad23e483f1d4ba0cba729968fa797331d5155bec9f2f8359c3498c690811e3bcb533f711b741e76e1

    • SSDEEP

      192:mEWqeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:Hg41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      inducted/dacha.tmp

    • Size

      624KB

    • MD5

      77fb229ad9f0cb302c0fbce5618218d8

    • SHA1

      32737dbdeaa46d58898539dff387b81b72c50afa

    • SHA256

      642434d7f91d92dc281ffaa1d2249ccd4b0a8418b8c353a43dd1b42bdc4fbe9d

    • SHA512

      12d76c200ab58f036502dbaea020d59d00d20a59ba08702b75b8279acfad61f84de59706e36c1057bdb3de8fe696b103b9096442e5c421f8f9cc5fbac396dfea

    • SSDEEP

      12288:i/TGcg+w9KC1JdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:i/TGckKC130IAIQR3O7OjHHAp

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks