Overview

overview

10

Static

static

LO30.iso

windows7-x64

3

LO30.iso

windows10-2004-x64

3

WW.js

windows7-x64

10

WW.js

windows10-2004-x64

10

port/enmity.dll

windows7-x64

10

port/enmity.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LO30.img

  • Size

    848KB

  • Sample

    221117-spkzfaag3x

  • MD5

    ea66dc4ed9a8b6bdc468355bea047eb2

  • SHA1

    c257365c246ecbfea389e2a93551a91b608f1c95

  • SHA256

    2b3c1cbe5454771e83d7f7a8571ed08a5e23ade79acb9596527a5bc5353351d1

  • SHA512

    e80e568ac5efb8fd0f731940c7b432513ef498d833e431853cd080cfd348292bcd1f9ce5dcfc2f9bfab2d31f3570f96fb7c05f92d47834c7eb48c222093ae0da

  • SSDEEP

    12288:xoDjGfBlhYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9QVN9:xoDjkzW8wWpD9u/VLM9Xq4nQVN9

Score
10/10
qakbotbb061668683197bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668683197

C2

23.240.47.58:995

12.172.173.82:465

91.169.12.198:32100

94.63.65.146:443

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

83.114.60.6:2222

86.171.75.63:443

86.195.32.149:2222

170.253.25.35:443

92.185.204.18:2078

157.231.42.190:995

170.249.59.153:443

174.101.111.4:443

116.74.163.152:443

76.80.180.154:995

180.151.104.143:443

86.130.9.167:2222

86.99.15.243:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      LO30.img

    • Size

      848KB

    • MD5

      ea66dc4ed9a8b6bdc468355bea047eb2

    • SHA1

      c257365c246ecbfea389e2a93551a91b608f1c95

    • SHA256

      2b3c1cbe5454771e83d7f7a8571ed08a5e23ade79acb9596527a5bc5353351d1

    • SHA512

      e80e568ac5efb8fd0f731940c7b432513ef498d833e431853cd080cfd348292bcd1f9ce5dcfc2f9bfab2d31f3570f96fb7c05f92d47834c7eb48c222093ae0da

    • SSDEEP

      12288:xoDjGfBlhYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9QVN9:xoDjkzW8wWpD9u/VLM9Xq4nQVN9

    Score
    3/10
    behavioral1behavioral2

    • Target

      WW.js

    • Size

      9KB

    • MD5

      769c52571f315c856e160436e765e8eb

    • SHA1

      faa334cbe24cfa31a19e1b0662e1b3230db284c6

    • SHA256

      082316a8ddd6ecbc299f5259f7433610278bac7bf616bb33bd5b22808ea65134

    • SHA512

      cbc2953b41d4dd6d5c003d0b7ffab5af6e4999f0afba7a057017dd076873c7576e7cbe0828dda000cacef181242e2bc9e04156a26d23cdaf151851fdd3b9188c

    • SSDEEP

      192:jFSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:UVq2k785UIro8KTMhSeYm5P2jiuuEjP4

    Score
    10/10
    qakbotbb061668683197bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      port/enmity.tmp

    • Size

      691KB

    • MD5

      8874e4ac299c3a10310127ff57e64fe9

    • SHA1

      a7e6817317a0748d09c91fa076d5a5317fdd816c

    • SHA256

      5262a6c97fb7ed4967b2d7a82f414fca2de65d6a7a072851a1dcd220a02d1f2e

    • SHA512

      b3f26e1446c0cd093fb2ed79aa93fc11e4bdac7a745231f93e4bce96fc7b0137b75b2eeeb94008f896961faa6173db64dfd41c76e7df0c54eb778f591d030b24

    • SSDEEP

      12288:sjGfBlhYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sjkzW8wWpD9u/VLM9Xq4n

    Score
    10/10
    qakbotbb061668683197bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks