Overview

overview

10

Static

static

CVQD68.iso

windows7-x64

3

CVQD68.iso

windows10-2004-x64

3

CV.vbs

windows7-x64

10

CV.vbs

windows10-2004-x64

10

inducted/c...de.dll

windows7-x64

10

inducted/c...de.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CVQD68.img

  • Size

    722KB

  • Sample

    221116-dm3zxach2z

  • MD5

    207cf18903882586280962ff3ccbf28d

  • SHA1

    915b97f7e6b279a099b9393466b37de1c9410eb5

  • SHA256

    81623f0482b30b1a3bd4c6089681bd4f2cf52d421f4ed68022629009326c0ca9

  • SHA512

    91f69fadc1da71738d264f24ffd4e3db56a38495c2261ff76768e8f9b3d2a63a2baacda0abd933c9307a73b50d4f8133fad727c56df7661a19d4da583aa6ce85

  • SSDEEP

    12288:bYX/TGcg+w9KCSJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:bYX/TGckKCS30IAIQR3O7OjHHApc

Score
10/10
qakbotbb061668492308bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

BB06

Campaign

1668492308

C2

49.175.72.56:443

81.229.117.95:2222

47.41.154.250:443

69.133.162.35:443

84.35.26.14:995

68.47.128.161:443

156.217.219.147:995

87.65.160.87:995

174.101.111.4:443

82.127.174.33:2222

91.169.12.198:32100

24.28.121.122:443

157.231.42.190:995

90.89.95.158:2222

74.33.84.227:443

24.64.114.59:2222

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

170.253.25.35:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      CVQD68.img

    • Size

      722KB

    • MD5

      207cf18903882586280962ff3ccbf28d

    • SHA1

      915b97f7e6b279a099b9393466b37de1c9410eb5

    • SHA256

      81623f0482b30b1a3bd4c6089681bd4f2cf52d421f4ed68022629009326c0ca9

    • SHA512

      91f69fadc1da71738d264f24ffd4e3db56a38495c2261ff76768e8f9b3d2a63a2baacda0abd933c9307a73b50d4f8133fad727c56df7661a19d4da583aa6ce85

    • SSDEEP

      12288:bYX/TGcg+w9KCSJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:bYX/TGckKCS30IAIQR3O7OjHHApc

    Score
    3/10
    behavioral1behavioral2

    • Target

      CV.vbs

    • Size

      9KB

    • MD5

      d1504ea6442d8a6c81763c555d4e6324

    • SHA1

      594490824d5d285e1eac8ec28f0a42f5eaa0b9f1

    • SHA256

      167fd7e3e625d1e80f7b6255881826ea95c26c234d08a06127ba32865c6abe1f

    • SHA512

      7c52d029e4a18b07d6b45fc85d569b59aabd4469e1583ae556d57f4fdcfef8e7c15ff2c16c093a6f21bd9cf2e4f53c7f68ad623dc7c831810c02565d4efc3d59

    • SSDEEP

      192:mEWCeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:HA41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      inducted/cannonade.tmp

    • Size

      624KB

    • MD5

      0aa46a7862a85bb4c257065c6d3847d9

    • SHA1

      e999bfdcba61342520dcf21f1d8b0d88f522afc7

    • SHA256

      ceddaf0969222eed1da30be49ea364ac1d19ee954187891cee426bb58d0fd2c2

    • SHA512

      47cffa8ed4967b947e39d0fc78554ca000263326dadf3a2c6031a040cc96b732e600d0ccea38b0a0621cd712d899d3ec40adfc1dbc35f83ac66dafec2b25262e

    • SSDEEP

      12288:i/TGcg+w9KCSJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:i/TGckKCS30IAIQR3O7OjHHAp

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks