Overview

overview

10

Static

static

HF18.iso

windows7-x64

3

HF18.iso

windows10-2004-x64

3

WW.js

windows7-x64

10

WW.js

windows10-2004-x64

10

port/steeply.dll

windows7-x64

10

port/steeply.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HF18.img

  • Size

    848KB

  • Sample

    221117-taygnaeh22

  • MD5

    2d70d9494414358360c8dd677188d9a3

  • SHA1

    0da6ef96af7fc9d7c73cbb9e68a15dd51fb433b8

  • SHA256

    756e04d2edc039bd7fd30f3516bf49c84f852401b3db14449aefc6f6ce69ad14

  • SHA512

    e1e83bf75888868ba615370729ba64e36f99161be878fcc8a7acbcde0d8251909e69576e0c05f509d2296fe7ad352d3b9d19643ea7ff21b5e9ddb75010c3ef3e

  • SSDEEP

    12288:sojVN9gjGfBlmYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sojVN9gjkeW8wWpD9u/VLM9Xq4n

Score
10/10
qakbotbb061668683197bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668683197

C2

23.240.47.58:995

12.172.173.82:465

91.169.12.198:32100

94.63.65.146:443

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

83.114.60.6:2222

86.171.75.63:443

86.195.32.149:2222

170.253.25.35:443

92.185.204.18:2078

157.231.42.190:995

170.249.59.153:443

174.101.111.4:443

116.74.163.152:443

76.80.180.154:995

180.151.104.143:443

86.130.9.167:2222

86.99.15.243:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      HF18.img

    • Size

      848KB

    • MD5

      2d70d9494414358360c8dd677188d9a3

    • SHA1

      0da6ef96af7fc9d7c73cbb9e68a15dd51fb433b8

    • SHA256

      756e04d2edc039bd7fd30f3516bf49c84f852401b3db14449aefc6f6ce69ad14

    • SHA512

      e1e83bf75888868ba615370729ba64e36f99161be878fcc8a7acbcde0d8251909e69576e0c05f509d2296fe7ad352d3b9d19643ea7ff21b5e9ddb75010c3ef3e

    • SSDEEP

      12288:sojVN9gjGfBlmYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sojVN9gjkeW8wWpD9u/VLM9Xq4n

    Score
    3/10
    behavioral1behavioral2

    • Target

      WW.js

    • Size

      9KB

    • MD5

      f13e13958d46670528a56801edf7d1ff

    • SHA1

      886db250c36120bdc418f358685c89b96ceae25e

    • SHA256

      e078fbee40d68309f65e89f312e753c1087e145873b500a24759877c3dfb665f

    • SHA512

      8cd6379615806814f37302747772ba4025d8ee226e2d9e0fd16da9f36a4bcd6b6da84084f7c3a3e82d7b060f687dfc7d61a6b501f22b07a78a2e8b684519290f

    • SSDEEP

      192:jrSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:OVq2k785UIro8KTMhSeYm5P2jiuuEjP4

    Score
    10/10
    qakbotbb061668683197bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      port/steeply.tmp

    • Size

      691KB

    • MD5

      2d3317582066fff48d8550cdc10924ee

    • SHA1

      1d2963f73a996d60aabd089716e5604c2a3ae8ee

    • SHA256

      19832f50c90d0cb108e7206081b9039c8168b7827652e4ab9ff217a354d6fe25

    • SHA512

      1418e11f2298f43d7fa61c275cf1a68e7e7d609413bcde3a52e4e65de950404f1a97a05b7cf9c921c7a9d17b58cf0e994d54da4c227b8f13b317c83a6e519226

    • SSDEEP

      12288:sjGfBlmYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sjkeW8wWpD9u/VLM9Xq4n

    Score
    10/10
    qakbotbb061668683197bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks