General

  • Target

    VE75.img

  • Size

    996KB

  • Sample

    221117-mxaksaac4x

  • MD5

    d0277134d2ad92f8eb332094abe951d0

  • SHA1

    138f0014d34024654606a2b25bb5a3aedff16696

  • SHA256

    0da4feaa0ea1d1a3951ee92ecdee100e89e42b48f0c86be29c9286492cd96d16

  • SHA512

    d276b3367fa60678719db2faf75f80693d8d5870cdcd64b6c43a416f947a3c0fca3fdcae9d780520204fb35c9e0d299522d22dd8d3c4e5152e308230c0341335

  • SSDEEP

    24576:DYKwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxr9MuI4vhL3tXC2Hk:JwvwJwRwJZwSw5wqwfHH8H2HHLwRuY0m

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668610672

C2

87.243.146.59:443

90.104.22.28:2222

200.93.14.206:2222

86.171.75.63:443

92.185.204.18:2078

86.225.214.138:2222

152.170.17.136:443

92.27.86.48:2222

76.80.180.154:995

71.31.101.183:443

91.254.215.167:443

73.22.121.210:443

87.202.101.164:50000

24.228.132.224:2222

70.121.198.103:2078

186.28.85.119:995

193.251.52.34:2222

98.211.64.94:443

172.117.139.142:995

70.51.153.72:2222

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      VE75.img

    • Size

      996KB

    • MD5

      d0277134d2ad92f8eb332094abe951d0

    • SHA1

      138f0014d34024654606a2b25bb5a3aedff16696

    • SHA256

      0da4feaa0ea1d1a3951ee92ecdee100e89e42b48f0c86be29c9286492cd96d16

    • SHA512

      d276b3367fa60678719db2faf75f80693d8d5870cdcd64b6c43a416f947a3c0fca3fdcae9d780520204fb35c9e0d299522d22dd8d3c4e5152e308230c0341335

    • SSDEEP

      24576:DYKwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxr9MuI4vhL3tXC2Hk:JwvwJwRwJZwSw5wqwfHH8H2HHLwRuY0m

    Score
    3/10
    • Target

      SK.vbs

    • Size

      9KB

    • MD5

      89474d688c0fcf7ea1d916357869af40

    • SHA1

      aa46a543e8e01becf12f8438626a33e72682325a

    • SHA256

      351cd8a8421eb0c61e293415ff44a9cb726c7bb0bc4e291ce41a8dc4ae9fbcc7

    • SHA512

      b3022c1b491126fef00f519fa69e5b3eda0fe3e0eae9b6abe888de602e7c4973371ff8f5007251999d89828eb0475029c0ea8fceaf70fa93bca1fe21064b6a5a

    • SSDEEP

      192:NeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:A41ajrcpE4rocCMhidGpPGmX0jWbX

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Target

      cushioned/puns.tmp

    • Size

      528KB

    • MD5

      51bd40ddd4c748a5b404b35effdf28e0

    • SHA1

      3a52201a38a53d60b8ad250d0d23943a5ea4b9c3

    • SHA256

      1866d32e1681d90210e349b80f78ae6f91da20a73f4e5223a3f31483aca8e4b9

    • SHA512

      8e25f412dd15419523d5cade5e5acc9cb7f678d2cab29d3f9bfa6bddd845298a87683b8e1f15a2dd1c9baea681a1bb2fdd7554140645d38dc3476446ab65ef41

    • SSDEEP

      12288:Sx4YGJ7FVsr0DUESxDf9TQGWCIQ1HvhL3iL/wXLK:Sx4Yk7A4DUESxr9MuI4vhL3tX

MITRE ATT&CK Enterprise v6

Tasks