Overview

overview

10

Static

static

CVRE68.iso

windows7-x64

3

CVRE68.iso

windows10-2004-x64

3

CV.vbs

windows7-x64

10

CV.vbs

windows10-2004-x64

10

inducted/c...ly.dll

windows7-x64

10

inducted/c...ly.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CVRE68.img

  • Size

    722KB

  • Sample

    221116-shzt1sbg95

  • MD5

    4d378671ed40d1c8c8636a808ce16383

  • SHA1

    32e0dbf2b932fd57c0707af03f9fe7ed33c51cc5

  • SHA256

    695dadfae91f75b6e5644269c866b2574576c738e2a9e1f031a074cf122c1877

  • SHA512

    db57c122374d29a08abf309fb585f291345eaf5890cdac7c92dc4d0c0cff02f71b4d3846c60a22c0a31faab7e3a18e112d985bc99bc4d8651d3a9675c506b530

  • SSDEEP

    12288:DYn/TGcg+w9KCvJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:DYn/TGckKCv30IAIQR3O7OjHHApc

Score
10/10
qakbotbb061668492308bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

BB06

Campaign

1668492308

C2

49.175.72.56:443

81.229.117.95:2222

47.41.154.250:443

69.133.162.35:443

84.35.26.14:995

68.47.128.161:443

156.217.219.147:995

87.65.160.87:995

174.101.111.4:443

82.127.174.33:2222

91.169.12.198:32100

24.28.121.122:443

157.231.42.190:995

90.89.95.158:2222

74.33.84.227:443

24.64.114.59:2222

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

170.253.25.35:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      CVRE68.img

    • Size

      722KB

    • MD5

      4d378671ed40d1c8c8636a808ce16383

    • SHA1

      32e0dbf2b932fd57c0707af03f9fe7ed33c51cc5

    • SHA256

      695dadfae91f75b6e5644269c866b2574576c738e2a9e1f031a074cf122c1877

    • SHA512

      db57c122374d29a08abf309fb585f291345eaf5890cdac7c92dc4d0c0cff02f71b4d3846c60a22c0a31faab7e3a18e112d985bc99bc4d8651d3a9675c506b530

    • SSDEEP

      12288:DYn/TGcg+w9KCvJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:DYn/TGckKCv30IAIQR3O7OjHHApc

    Score
    3/10
    behavioral1behavioral2

    • Target

      CV.vbs

    • Size

      9KB

    • MD5

      f1e1d3ed7c59401139eb399bfd4d659e

    • SHA1

      e22c903e93bda756f4c7014214e957818bb880df

    • SHA256

      a7b6edc635b3066847ae81e9f9ad3667c6132abc3ad1e8cf27ae6fc6fc5580a3

    • SHA512

      a9ba5f923a493a891570c9c5f36272f74a780d33be5ea4a7be6910fca079d05da5092dc8ae5921c5db664a685e2dcdca8736aee983338e74f84745379b63d078

    • SSDEEP

      192:mEWGeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:Ho41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      inducted/confoundingly.tmp

    • Size

      624KB

    • MD5

      601cb7df23eb0518ada227979e70057a

    • SHA1

      ddaa3ff6402cbeea5e6df7a87e65147a465daa7a

    • SHA256

      378977f39ffadaa31429cccd64b66413bf37cee974e61d6dde9f0265a1113c70

    • SHA512

      0a0d55fd310f7dce1951e8c5a09af919f49b36a78590345e90ad02019a80e3d9b5449c98085917d15a428e496f4acda209606095d522717af3af7aaa28d7e857

    • SSDEEP

      12288:i/TGcg+w9KCvJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:i/TGckKCv30IAIQR3O7OjHHAp

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks