Overview

overview

10

Static

static

GU64.iso

windows7-x64

3

GU64.iso

windows10-2004-x64

3

SK.vbs

windows7-x64

10

SK.vbs

windows10-2004-x64

10

cushioned/...ry.dll

windows7-x64

10

cushioned/...ry.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GU64.img

  • Size

    996KB

  • Sample

    221117-mctsxseb57

  • MD5

    5d72f4298b7e46863528d29bb9970ada

  • SHA1

    bfd1c92d38c3fd526ebc7c6042646021c9cb53e5

  • SHA256

    a2f0d211d4b37739801917b75e21733d390cc01192ce23c0d591b36cce76f541

  • SHA512

    5d214640e7f516aa0563511564db20b8e2d0828609111ea933590985f17c38e9c3406270f9c54569f5c8736351d208955b7c1b6be2a3e3bd9ca9aba8a86e0a0a

  • SSDEEP

    24576:bY9x4Yk7A4DUESxH9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:6uY0ArH0T4vJ3tXwwvwJwRwJZwSw5wqj

Score
10/10
qakbotbb061668610672bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668610672

C2

87.243.146.59:443

90.104.22.28:2222

200.93.14.206:2222

86.171.75.63:443

92.185.204.18:2078

86.225.214.138:2222

152.170.17.136:443

92.27.86.48:2222

76.80.180.154:995

71.31.101.183:443

91.254.215.167:443

73.22.121.210:443

87.202.101.164:50000

24.228.132.224:2222

70.121.198.103:2078

186.28.85.119:995

193.251.52.34:2222

98.211.64.94:443

172.117.139.142:995

70.51.153.72:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      GU64.img

    • Size

      996KB

    • MD5

      5d72f4298b7e46863528d29bb9970ada

    • SHA1

      bfd1c92d38c3fd526ebc7c6042646021c9cb53e5

    • SHA256

      a2f0d211d4b37739801917b75e21733d390cc01192ce23c0d591b36cce76f541

    • SHA512

      5d214640e7f516aa0563511564db20b8e2d0828609111ea933590985f17c38e9c3406270f9c54569f5c8736351d208955b7c1b6be2a3e3bd9ca9aba8a86e0a0a

    • SSDEEP

      24576:bY9x4Yk7A4DUESxH9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:6uY0ArH0T4vJ3tXwwvwJwRwJZwSw5wqj

    Score
    3/10
    behavioral1behavioral2

    • Target

      SK.vbs

    • Size

      9KB

    • MD5

      906c24a4c92c9f444685b664e151d1ff

    • SHA1

      9b2ac2aa2b12932b6c6c839a3bb2e0cacb20072c

    • SHA256

      d49a051ce6ea15184ffbc6981cb5ad94de871587854f22c03ef3e70e1abab536

    • SHA512

      778fe9dc5c2b56984a76688cf48ec9647deba29d658f808195da2d14ee51a24ec3dc26ae50a342a25e09c564eebc17ed9015b1261a37fc8400a82fb96b38a346

    • SSDEEP

      192:GeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:d41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      cushioned/infirmary.tmp

    • Size

      528KB

    • MD5

      7022ae49c9247cbf73249bc82ee452e3

    • SHA1

      0952ebed9e1082eaea48098322a7b96bb015cf2a

    • SHA256

      36c40bd7d1b664ab4f9c14be269562c73563b96f211a8a996842bdadd9781f63

    • SHA512

      d72ad5df7e27cf492972d45b1446a78b88960e2dc072d2bd5dac114b9391f960952b32cbc641a685889febb05853f05d1ee8e1ede04de9ca24958ce95773c8b5

    • SSDEEP

      12288:Sx4YGJ7FVsr0DUESx/f9TQGWCIQ1HvhL3iL/wXLK:Sx4Yk7A4DUESxH9MuI4vhL3tX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks