Overview

overview

10

Static

static

CVMR48.iso

windows7-x64

3

CVMR48.iso

windows10-2004-x64

3

CV.vbs

windows7-x64

10

CV.vbs

windows10-2004-x64

10

inducted/dissolve.dll

windows7-x64

10

inducted/dissolve.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CVMR48.img

  • Size

    722KB

  • Sample

    221116-tlpnwsfh8z

  • MD5

    47d7dca11c769e6826d5db2e6628308a

  • SHA1

    8deb022fc3124d476b879ca092f34a88fbcb8e17

  • SHA256

    70940403418c0567a91c9714846bf9648e8b940bdf97b1b1d335ef828b118796

  • SHA512

    ecf35483ddc127770d88a6fbd307f3108735b4897d43b20c18fe184c174214842e50d99d8b27aee3de2fe4fb548652f5bc5a2f86641e9b61904e1fccb394dc30

  • SSDEEP

    12288:aYJ/TGcg+w9KCyJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:aYJ/TGckKCy30IAIQR3O7OjHHApc

Score
10/10
qakbotbb061668492308bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

BB06

Campaign

1668492308

C2

49.175.72.56:443

81.229.117.95:2222

47.41.154.250:443

69.133.162.35:443

84.35.26.14:995

68.47.128.161:443

156.217.219.147:995

87.65.160.87:995

174.101.111.4:443

82.127.174.33:2222

91.169.12.198:32100

24.28.121.122:443

157.231.42.190:995

90.89.95.158:2222

74.33.84.227:443

24.64.114.59:2222

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

170.253.25.35:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      CVMR48.img

    • Size

      722KB

    • MD5

      47d7dca11c769e6826d5db2e6628308a

    • SHA1

      8deb022fc3124d476b879ca092f34a88fbcb8e17

    • SHA256

      70940403418c0567a91c9714846bf9648e8b940bdf97b1b1d335ef828b118796

    • SHA512

      ecf35483ddc127770d88a6fbd307f3108735b4897d43b20c18fe184c174214842e50d99d8b27aee3de2fe4fb548652f5bc5a2f86641e9b61904e1fccb394dc30

    • SSDEEP

      12288:aYJ/TGcg+w9KCyJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:aYJ/TGckKCy30IAIQR3O7OjHHApc

    Score
    3/10
    behavioral1behavioral2

    • Target

      CV.vbs

    • Size

      9KB

    • MD5

      60ab63c16566db526ff82734370b753f

    • SHA1

      71d43a361e042684f2e41e0f02245d7f39de878d

    • SHA256

      787eb0fd018f816d909a1a01a017175e9765392e63cf7c1bf1fa1549f7792dbe

    • SHA512

      238d33849e1240b237d80311f9748a0b639068e2b9cb95be11f349b739193f86ea77cb367d21ea31d6915c3f2315e26a08ada1e6506e838b6ad4af7370030cb0

    • SSDEEP

      192:mEWweSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:Hg41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      inducted/dissolve.tmp

    • Size

      624KB

    • MD5

      61cb51a3422ad88774ec78dc24a2bcae

    • SHA1

      349a2830a85c2dead6086af220095240ac25b504

    • SHA256

      abfc28ce48d181c493f9c06840d2a0f133279cd224f0904a658b9fdda0db574e

    • SHA512

      b1e5cd2906187260853ed88daab2de1d18d15ac87e4a6b1f8ddffcf2ad26b1610af7b67ccaa09bd2efab995fdc62d56c025306700686952fec23cff7ee4c4f0e

    • SSDEEP

      12288:i/TGcg+w9KCyJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:i/TGckKCy30IAIQR3O7OjHHAp

    Score
    10/10
    qakbotbb061668492308bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks