Overview

overview

10

Static

static

IC91.iso

windows7-x64

3

IC91.iso

windows10-2004-x64

3

SK.vbs

windows7-x64

10

SK.vbs

windows10-2004-x64

10

cushioned/potent.dll

windows7-x64

10

cushioned/potent.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IC91.img

  • Size

    996KB

  • Sample

    221117-dezyaahe6z

  • MD5

    587a6bd50e03be2986783fa1dc0d6865

  • SHA1

    27c5c3896ed3df8111cde46be4a3b8f891b7158a

  • SHA256

    fc338b3fcd6575237006e1649be552d875140cf36fe389bada70941a6c264773

  • SHA512

    5ed6b52a11502ed052ee38bf0afdd738f238e33ac15db89a753e1534003817954d22b21ce651568f6c958cf6bb70715364c51c9003d3711cbdb7db2a832d0f91

  • SSDEEP

    24576:fYSwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxY9MuI4vhL3tXC2Hk:1wvwJwRwJZwSw5wqwfHH8H2HHLwRuY0R

Score
10/10
qakbotbb061668610672bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668610672

C2

87.243.146.59:443

90.104.22.28:2222

200.93.14.206:2222

86.171.75.63:443

92.185.204.18:2078

86.225.214.138:2222

152.170.17.136:443

92.27.86.48:2222

76.80.180.154:995

71.31.101.183:443

91.254.215.167:443

73.22.121.210:443

87.202.101.164:50000

24.228.132.224:2222

70.121.198.103:2078

186.28.85.119:995

193.251.52.34:2222

98.211.64.94:443

172.117.139.142:995

70.51.153.72:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      IC91.img

    • Size

      996KB

    • MD5

      587a6bd50e03be2986783fa1dc0d6865

    • SHA1

      27c5c3896ed3df8111cde46be4a3b8f891b7158a

    • SHA256

      fc338b3fcd6575237006e1649be552d875140cf36fe389bada70941a6c264773

    • SHA512

      5ed6b52a11502ed052ee38bf0afdd738f238e33ac15db89a753e1534003817954d22b21ce651568f6c958cf6bb70715364c51c9003d3711cbdb7db2a832d0f91

    • SSDEEP

      24576:fYSwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxY9MuI4vhL3tXC2Hk:1wvwJwRwJZwSw5wqwfHH8H2HHLwRuY0R

    Score
    3/10
    behavioral1behavioral2

    • Target

      SK.vbs

    • Size

      9KB

    • MD5

      f9df29191ff2e589cca880e1f73b77f8

    • SHA1

      031392fd25fbd4508b11ad392afc10d2c9bc2238

    • SHA256

      467fc5f146b60376c27730b5bac249d14d19f385a3e1ffcad779ddbee197f981

    • SHA512

      fd65f2ce66814af38b8730894ad932c351b232af1c5f7f6c8d2ae88f6039d744e1215105d9176a258e4f088c634a1bcf487e3f9bf5826164d0c1808403c34f77

    • SSDEEP

      192:NeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:A41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      cushioned/potent.tmp

    • Size

      528KB

    • MD5

      d98a8f33cb0327fc306cd35cfc665036

    • SHA1

      8b3a36fbe5aa5bab5282c63c0502c82370054fd9

    • SHA256

      7d68bc3069a033923ad43b270ccc56a958f2f4225fff309631323826d537ce61

    • SHA512

      3fa58db2a0e09d84e12861a84f155a4d7efcfad360f0be2075ac8db8d337480ed6c8baef3584f95ce8e39d0a3744627dd7f4ce852bafde9400cebfb4b988fe62

    • SSDEEP

      12288:Sx4YGJ7FVsr0DUESxif9TQGWCIQ1HvhL3iL/wXLK:Sx4Yk7A4DUESxY9MuI4vhL3tX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks