Overview

overview

10

Static

static

UZ08.iso

windows7-x64

3

UZ08.iso

windows10-2004-x64

3

SK.vbs

windows7-x64

10

SK.vbs

windows10-2004-x64

10

cushioned/multi.dll

windows7-x64

10

cushioned/multi.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UZ08.img

  • Size

    996KB

  • Sample

    221117-dzcy9ahe9s

  • MD5

    419b2dbb878c76168c184805d8ac38e5

  • SHA1

    25416b5d0481bf7213b6eb08aed3d033f8d3615b

  • SHA256

    c74708ce68f102dae62385f9665d9eb1cde9e9143e6f01a27e0f42a76f248030

  • SHA512

    b33b2dd2b34b300156f11b506b6f75f314faa05c9863e4487bda06d23f89121944289d13f1b1cc99cf36d27ca2415384768009fc57e9127f8ebfd98491207dbe

  • SSDEEP

    24576:PYYwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxZ9MuI4vhL3tXC2Hk:FwvwJwRwJZwSw5wqwfHH8H2HHLwRuY0M

Score
10/10
qakbotbb061668610672bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668610672

C2

87.243.146.59:443

90.104.22.28:2222

200.93.14.206:2222

86.171.75.63:443

92.185.204.18:2078

86.225.214.138:2222

152.170.17.136:443

92.27.86.48:2222

76.80.180.154:995

71.31.101.183:443

91.254.215.167:443

73.22.121.210:443

87.202.101.164:50000

24.228.132.224:2222

70.121.198.103:2078

186.28.85.119:995

193.251.52.34:2222

98.211.64.94:443

172.117.139.142:995

70.51.153.72:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      UZ08.img

    • Size

      996KB

    • MD5

      419b2dbb878c76168c184805d8ac38e5

    • SHA1

      25416b5d0481bf7213b6eb08aed3d033f8d3615b

    • SHA256

      c74708ce68f102dae62385f9665d9eb1cde9e9143e6f01a27e0f42a76f248030

    • SHA512

      b33b2dd2b34b300156f11b506b6f75f314faa05c9863e4487bda06d23f89121944289d13f1b1cc99cf36d27ca2415384768009fc57e9127f8ebfd98491207dbe

    • SSDEEP

      24576:PYYwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxZ9MuI4vhL3tXC2Hk:FwvwJwRwJZwSw5wqwfHH8H2HHLwRuY0M

    Score
    3/10
    behavioral1behavioral2

    • Target

      SK.vbs

    • Size

      9KB

    • MD5

      3a45e2d2f0aca20277bbee2131319222

    • SHA1

      fe659baffc502325ffb04ab6cae560a47bb7d240

    • SHA256

      39023be27cb2418533ab04412a00253d48cfc6af89e8f0103fd4e7b4684b103c

    • SHA512

      e22fbfbc39d20ee6d8ee6f687c233727c7863074a78ef501de839d6c6de1a44cc06613da3a11085c7a895f5cc1ff35e7d5ad0853c0d6f77b4241be7c1bbf1ea2

    • SSDEEP

      192:AeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:r41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      cushioned/multi.tmp

    • Size

      528KB

    • MD5

      60dc36d523554bef3cd81b40e0165083

    • SHA1

      b753e9253db110acb4eab3a3bbd7f77c674201a9

    • SHA256

      619a580a8866b53a1929029df1cae075c89f483b1844c8c092ab5db1eab48450

    • SHA512

      8eabd08f51489ca3458f5939e8b371e65e1dcc31a381dc0a7100e2f364a54980a5ca69a77c574ec39f8c2ef087af470b1c9d45f6e13c1f4e2879a64b2ee7e240

    • SSDEEP

      12288:Sx4YGJ7FVsr0DUESxdf9TQGWCIQ1HvhL3iL/wXLK:Sx4Yk7A4DUESxZ9MuI4vhL3tX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks