Overview

overview

10

Static

static

NH09.iso

windows7-x64

3

NH09.iso

windows10-2004-x64

3

SK.vbs

windows7-x64

10

SK.vbs

windows10-2004-x64

10

cushioned/gaits.dll

windows7-x64

10

cushioned/gaits.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NH09.img

  • Size

    996KB

  • Sample

    221117-hr53aadg96

  • MD5

    afd3aafce1eb18f0c75691c04a6067a8

  • SHA1

    f9a977a82d69d42535032fb54dabf1a18e2278dd

  • SHA256

    3ebcabb9a00211e1aa0ec6509f4d6206e6fab30da4a5bf6267292b9578859393

  • SHA512

    f175da5e38239cf7134084c8ab56eadfe13ac811585f3ea397ac8ff197efe7468b1bb3ae487f53006a978bafc6691ee384f6c63de10ddaac3718fed43e4023e6

  • SSDEEP

    24576:aYNx4Yk7A4DUESxr9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:HuY0ArHgT4vJ3tXwwvwJwRwJZwSw5wqj

Score
10/10
qakbotbb061668610672bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668610672

C2

87.243.146.59:443

90.104.22.28:2222

200.93.14.206:2222

86.171.75.63:443

92.185.204.18:2078

86.225.214.138:2222

152.170.17.136:443

92.27.86.48:2222

76.80.180.154:995

71.31.101.183:443

91.254.215.167:443

73.22.121.210:443

87.202.101.164:50000

24.228.132.224:2222

70.121.198.103:2078

186.28.85.119:995

193.251.52.34:2222

98.211.64.94:443

172.117.139.142:995

70.51.153.72:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      NH09.img

    • Size

      996KB

    • MD5

      afd3aafce1eb18f0c75691c04a6067a8

    • SHA1

      f9a977a82d69d42535032fb54dabf1a18e2278dd

    • SHA256

      3ebcabb9a00211e1aa0ec6509f4d6206e6fab30da4a5bf6267292b9578859393

    • SHA512

      f175da5e38239cf7134084c8ab56eadfe13ac811585f3ea397ac8ff197efe7468b1bb3ae487f53006a978bafc6691ee384f6c63de10ddaac3718fed43e4023e6

    • SSDEEP

      24576:aYNx4Yk7A4DUESxr9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:HuY0ArHgT4vJ3tXwwvwJwRwJZwSw5wqj

    Score
    3/10
    behavioral1behavioral2

    • Target

      SK.vbs

    • Size

      9KB

    • MD5

      6a3e7bff523fc5682cdbe680e893a0b0

    • SHA1

      6bb3ae258d2d89046208146648d66c74a7e56881

    • SHA256

      0a2517ba490993ba5b29c71d209e413ac04ffc6d300740e43b74d947e9dfc0e5

    • SHA512

      f886d218488ff1190b6f8926a53b2e156bf31f584dfbb1d5497d1329c1e2ea6680e1d822be31e7a7af0a3b73f8ff960ceb22f77c6ffaedfdd8b5d7806cf1f36f

    • SSDEEP

      192:JeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:U41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      cushioned/gaits.tmp

    • Size

      528KB

    • MD5

      0592b32dc33408df208fa9ee07d5fd2c

    • SHA1

      2264ee56cb6ed076e693b0f3a315412944ac3675

    • SHA256

      fed8771b0548b5c7c57ff76b609ec2183fdf435b24e3b37f01ff4822d01daf54

    • SHA512

      6a4a05c12a5627a4ea393797a43d7db7048bc1bdad4fb0265823570e499ef36f0224a790bdf09d6fb5144c612f55aeb23eaef192b85cbc999f13b3ff7e3f6836

    • SSDEEP

      12288:Sx4YGJ7FVsr0DUESxDf9TQGWCIQ1HvhL3iL/wXLK:Sx4Yk7A4DUESxr9MuI4vhL3tX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks