Overview

overview

10

Static

static

CVSM58.iso

windows7-x64

3

CVSM58.iso

windows10-2004-x64

3

CV.vbs

windows7-x64

10

CV.vbs

windows10-2004-x64

10

inducted/sheila.dll

windows7-x64

10

inducted/sheila.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CVSM58.img

  • Size

    722KB

  • Sample

    221116-k397gsdh2v

  • MD5

    490a289973a6e18a3970d3c092fc425d

  • SHA1

    bae6731a30753903fa03d1ecb690d38cc8e0760c

  • SHA256

    351025529c0a38aa351e96c58143f41798f1dd26be05431aae60ca092c07c22e

  • SHA512

    6061376a94f8b2e7372c1f3b969244430084a695d2b393bf2a7d9961d9ea5c19df4708adb23ad9645547944b7a9b70986c37a703f2e3051a78f51603f1d1300f

  • SSDEEP

    12288:fYIq/TGcg+w9KCzJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:fYIq/TGckKCz30IAIQR3O7OjHHAp

Score
10/10
qakbotbb061668492308bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

BB06

Campaign

1668492308

C2

49.175.72.56:443

81.229.117.95:2222

47.41.154.250:443

69.133.162.35:443

84.35.26.14:995

68.47.128.161:443

156.217.219.147:995

87.65.160.87:995

174.101.111.4:443

82.127.174.33:2222

91.169.12.198:32100

24.28.121.122:443

157.231.42.190:995

90.89.95.158:2222

74.33.84.227:443

24.64.114.59:2222

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

170.253.25.35:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      CVSM58.img

    • Size

      722KB

    • MD5

      490a289973a6e18a3970d3c092fc425d

    • SHA1

      bae6731a30753903fa03d1ecb690d38cc8e0760c

    • SHA256

      351025529c0a38aa351e96c58143f41798f1dd26be05431aae60ca092c07c22e

    • SHA512

      6061376a94f8b2e7372c1f3b969244430084a695d2b393bf2a7d9961d9ea5c19df4708adb23ad9645547944b7a9b70986c37a703f2e3051a78f51603f1d1300f

    • SSDEEP

      12288:fYIq/TGcg+w9KCzJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:fYIq/TGckKCz30IAIQR3O7OjHHAp

    Score
    3/10
    behavioral1behavioral2

    • Target

      CV.vbs

    • Size

      9KB

    • MD5

      273443f4d30fd078c0c2399f4f5c0b70

    • SHA1

      99debb833f69a4729cb6fb9be82ba078ed231fdf

    • SHA256

      9b59c78c60944b5dfd1bb7f3b5a8e5e2a70ab0c8c5ee18f990ab0c50ab7c3e61

    • SHA512

      23d45ce5380f257e14568f07bc57018a3c26cc3b811606d2284a608daf06f4b0db47db94d82cae8e5c059ef9fad100c631555ea19265ada91e9edb7a347157b6

    • SSDEEP

      192:mEWTeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:H941ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      inducted/sheila.tmp

    • Size

      624KB

    • MD5

      7eed04e62f22103fbe08c1176eaade97

    • SHA1

      7bd40e6dbc6d27d7a5e08a27f27d136213538ab5

    • SHA256

      8bf641fb2c78dd293b9e8789f49f27d2b931b608250036f61a26218f7816c34c

    • SHA512

      551b756246fa32f54f42c608d6744642e52cce8032d88acba926cea9209de3ea6d40f8bbcd29df35cc65460411d18cefb93e4af32ac1a81ea0590133eb8c1a4a

    • SSDEEP

      12288:i/TGcg+w9KCzJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:i/TGckKCz30IAIQR3O7OjHHAp

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks