Overview

overview

10

Static

static

ZU27.iso

windows7-x64

3

ZU27.iso

windows10-2004-x64

3

SK.vbs

windows7-x64

10

SK.vbs

windows10-2004-x64

10

cushioned/...rs.dll

windows7-x64

10

cushioned/...rs.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ZU27.img

  • Size

    996KB

  • Sample

    221116-3xms4shc8z

  • MD5

    70301e565772867a4d58f10b9c0f82dd

  • SHA1

    96ada21593240ad719ab0f377f4dcec8a41549ff

  • SHA256

    c04a3e6371204d04475266a6e60b9ca68db94b0cdf08dd7695c97bcab3891070

  • SHA512

    f87903d2b4d9464debeddc149134b45008e1535cf3efd710ea23c73666bb4d202a189882261e0a8ad2d43a35b614cc87f7e8e86159f4369a03a551b2bcd17d1a

  • SSDEEP

    24576:HYgwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxG9MuI4vhL3tXC2Hk:twvwJwRwJZwSw5wqwfHH8H2HHLwRuY0P

Score
10/10
qakbotbb061668610672bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668610672

C2

87.243.146.59:443

90.104.22.28:2222

200.93.14.206:2222

86.171.75.63:443

92.185.204.18:2078

86.225.214.138:2222

152.170.17.136:443

92.27.86.48:2222

76.80.180.154:995

71.31.101.183:443

91.254.215.167:443

73.22.121.210:443

87.202.101.164:50000

24.228.132.224:2222

70.121.198.103:2078

186.28.85.119:995

193.251.52.34:2222

98.211.64.94:443

172.117.139.142:995

70.51.153.72:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      ZU27.img

    • Size

      996KB

    • MD5

      70301e565772867a4d58f10b9c0f82dd

    • SHA1

      96ada21593240ad719ab0f377f4dcec8a41549ff

    • SHA256

      c04a3e6371204d04475266a6e60b9ca68db94b0cdf08dd7695c97bcab3891070

    • SHA512

      f87903d2b4d9464debeddc149134b45008e1535cf3efd710ea23c73666bb4d202a189882261e0a8ad2d43a35b614cc87f7e8e86159f4369a03a551b2bcd17d1a

    • SSDEEP

      24576:HYgwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxG9MuI4vhL3tXC2Hk:twvwJwRwJZwSw5wqwfHH8H2HHLwRuY0P

    Score
    3/10
    behavioral1behavioral2

    • Target

      SK.vbs

    • Size

      9KB

    • MD5

      8e58c551411c46169d691c209d23bcce

    • SHA1

      d78757021ddb30a4ca7474bbe351787a4a8445c4

    • SHA256

      4e9fbb1f47dc124d305659752db02a1a514c2bad1c919b6c0069861ef9c1a115

    • SHA512

      4311f2c5d5242434992b7681eec5f10895b8792c531b19d7b697ce42c0274927385d4eff7a68f362b646d26170a5a33f8f8e5088d0330a3c3a419e8d4782adb4

    • SSDEEP

      192:neSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:e41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      cushioned/multipliers.tmp

    • Size

      528KB

    • MD5

      a9d64b43e6e9e3993fd5afda5c558229

    • SHA1

      9becf828784af3034c1db23e27786cb7e5ed0d43

    • SHA256

      7a4f9699478c1476c2c901b39b89b1c0a9bd83ffe1e180bab22bf697c99141fb

    • SHA512

      cead169f8e6948afbcbe8810599eda4550730db318890968ea103f4264bce59b5fac30cab7967482c6ebd1a3343b85177f0a5f966134c24cf033c42064eb9a67

    • SSDEEP

      12288:Sx4YGJ7FVsr0DUESx0f9TQGWCIQ1HvhL3iL/wXLK:Sx4Yk7A4DUESxG9MuI4vhL3tX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks