Overview

overview

10

Static

static

MO96.iso

windows7-x64

3

MO96.iso

windows10-2004-x64

3

SK.vbs

windows7-x64

10

SK.vbs

windows10-2004-x64

10

cushioned/peered.dll

windows7-x64

10

cushioned/peered.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MO96.img

  • Size

    996KB

  • Sample

    221117-g8r2bahg7w

  • MD5

    3c225cd46ccf8dcae455651c4cec4f5f

  • SHA1

    bdc9ec4221c7b49c3e86fc78fa59f923211afbb2

  • SHA256

    4f7409277fe2420ca3aa0c567c60bafdde4d97692a2755dab6b386f10e2874d4

  • SHA512

    6132e5723d5f87bc39511e96f4ea659ac78327777b7dde96e667296ef8601e710d2d9565f881103e88377a9af1526b2a847d0fee262edebd07dfa43568099d31

  • SSDEEP

    24576:+YSwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxv9MuI4vhL3tXC2Hk:kwvwJwRwJZwSw5wqwfHH8H2HHLwRuY02

Score
10/10
qakbotbb061668610672bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668610672

C2

87.243.146.59:443

90.104.22.28:2222

200.93.14.206:2222

86.171.75.63:443

92.185.204.18:2078

86.225.214.138:2222

152.170.17.136:443

92.27.86.48:2222

76.80.180.154:995

71.31.101.183:443

91.254.215.167:443

73.22.121.210:443

87.202.101.164:50000

24.228.132.224:2222

70.121.198.103:2078

186.28.85.119:995

193.251.52.34:2222

98.211.64.94:443

172.117.139.142:995

70.51.153.72:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      MO96.img

    • Size

      996KB

    • MD5

      3c225cd46ccf8dcae455651c4cec4f5f

    • SHA1

      bdc9ec4221c7b49c3e86fc78fa59f923211afbb2

    • SHA256

      4f7409277fe2420ca3aa0c567c60bafdde4d97692a2755dab6b386f10e2874d4

    • SHA512

      6132e5723d5f87bc39511e96f4ea659ac78327777b7dde96e667296ef8601e710d2d9565f881103e88377a9af1526b2a847d0fee262edebd07dfa43568099d31

    • SSDEEP

      24576:+YSwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxv9MuI4vhL3tXC2Hk:kwvwJwRwJZwSw5wqwfHH8H2HHLwRuY02

    Score
    3/10
    behavioral1behavioral2

    • Target

      SK.vbs

    • Size

      9KB

    • MD5

      773829cec0453b621a83da8b99dc10a2

    • SHA1

      17356ea30feab574b8ec0ec0726e8826b8902ae2

    • SHA256

      f037ba0443a2f3eedd306862763cc19e0fd78cf08b57ad64e24b7269c50efb46

    • SHA512

      e9464f6418bf2e826601e53e428e92a06853f456875ab060c45a3431a7885cd13d698cbe188de355f47f85e57b72e1293b4f28e7189060c210578dcdc48928a0

    • SSDEEP

      192:2eSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:t41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      cushioned/peered.tmp

    • Size

      528KB

    • MD5

      b9ce340a2915e4559736e003bad39a74

    • SHA1

      ed5c506fcf742e557916af3ed60c441db92b8a0e

    • SHA256

      6b5ee41381dbe01a4396e818e8bbdab21e526b5badd7847668f0edba4d1e51a6

    • SHA512

      9a25bbafef7ce06b3cadca66b176083ca66af566ce4c4411c5274525069b58d4428b1be56cee66e7e1880c58c008bafadd790d5cf63e6df8c58e138bd41e40fd

    • SSDEEP

      12288:Sx4YGJ7FVsr0DUESx3f9TQGWCIQ1HvhL3iL/wXLK:Sx4Yk7A4DUESxv9MuI4vhL3tX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks