Overview

overview

10

Static

static

BM60.iso

windows7-x64

3

BM60.iso

windows10-2004-x64

3

SK.vbs

windows7-x64

10

SK.vbs

windows10-2004-x64

10

cushioned/crayons.dll

windows7-x64

10

cushioned/crayons.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BM60.img

  • Size

    996KB

  • Sample

    221117-r9lwssef69

  • MD5

    cf9aeaf54a281bf0a2ab48e750479e80

  • SHA1

    afa29cd00e7771f65374acd5a9fd5070cf2f7e31

  • SHA256

    4c127558b558302c7d3ed931fc499bd8570a3939d63f4a78225c0795d9a4ba84

  • SHA512

    decdb2beb72da78a65c62647270a683772b63e1350f3eccf68bccda01a3b1ff40943e8491711359c54278ed4998d011cf16997cd5e2a95d538b77eb26b26aaef

  • SSDEEP

    24576:pYFx4Yk7A4DUESxC9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:8uY0ArH7T4vJ3tXwwvwJwRwJZwSw5wqj

Score
10/10
qakbotbb061668610672bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668610672

C2

87.243.146.59:443

90.104.22.28:2222

200.93.14.206:2222

86.171.75.63:443

92.185.204.18:2078

86.225.214.138:2222

152.170.17.136:443

92.27.86.48:2222

76.80.180.154:995

71.31.101.183:443

91.254.215.167:443

73.22.121.210:443

87.202.101.164:50000

24.228.132.224:2222

70.121.198.103:2078

186.28.85.119:995

193.251.52.34:2222

98.211.64.94:443

172.117.139.142:995

70.51.153.72:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      BM60.img

    • Size

      996KB

    • MD5

      cf9aeaf54a281bf0a2ab48e750479e80

    • SHA1

      afa29cd00e7771f65374acd5a9fd5070cf2f7e31

    • SHA256

      4c127558b558302c7d3ed931fc499bd8570a3939d63f4a78225c0795d9a4ba84

    • SHA512

      decdb2beb72da78a65c62647270a683772b63e1350f3eccf68bccda01a3b1ff40943e8491711359c54278ed4998d011cf16997cd5e2a95d538b77eb26b26aaef

    • SSDEEP

      24576:pYFx4Yk7A4DUESxC9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:8uY0ArH7T4vJ3tXwwvwJwRwJZwSw5wqj

    Score
    3/10
    behavioral1behavioral2

    • Target

      SK.vbs

    • Size

      9KB

    • MD5

      8de02f121828304b0f030cd77d7c1052

    • SHA1

      8854dfe8fc12382ad4139371912f19be59666c55

    • SHA256

      6ecd661c5c0a3ada059abbb26a1c648a938cbd61c682654a396449c3ef0560a5

    • SHA512

      7789e7dc6c2d5f42576d56ea3613cbdfe9345eba62d2c639baeb75e3cc218233e8bf361065b1d647b2b009fe5a5da4fd51f69a20f124ba43f731f0e1a1f7d90c

    • SSDEEP

      192:2eSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:t41ajrcpE4rocCMhidGpPGmX0jWbX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      cushioned/crayons.tmp

    • Size

      528KB

    • MD5

      a35e772213da782df828cc39db9d1091

    • SHA1

      5b6b2492375d64e36cf87e1418ac43031e5e460a

    • SHA256

      4d06970147bcc617a7c1b4e4bf37b25b6313489b997e8d4041a072f5c23a4a49

    • SHA512

      3176be5e300ebe785bb52cb19f364fb86825346520be5f5cf2473256672abfaaf5e554e5fe887fa5e9c33a3cc24c652dd834a88987a6ffaf95ea8ecd42cd9b9b

    • SSDEEP

      12288:Sx4YGJ7FVsr0DUESxAf9TQGWCIQ1HvhL3iL/wXLK:Sx4Yk7A4DUESxC9MuI4vhL3tX

    Score
    10/10
    qakbotbb061668610672bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks