General

  • Target

    UY76.zip

  • Size

    312KB

  • Sample

    221117-tmxqwsah4y

  • MD5

    24ba387def3000f1b07b3cc3c90fdefb

  • SHA1

    d283ec0dd0b93c24b7fdc77e47f1ee8a1617e8c9

  • SHA256

    451e5353ca08889889954cf87c996299207f3e862fef83411e5ec34e0846ce71

  • SHA512

    945067835c3fec97702b2e8a57a3536a44632b368ffeee2482ab8067aae4f514a06acce2f6a4c37ca5752b8da129c0cd2f1648759c6bf38b6b18bd3747cea1da

  • SSDEEP

    6144:2N+2e6ljb27F05CvUNc1QlisFHJ/NJyKWVXSDAOsKMvrgjC3VLWEl3c5cNn:ZP65yp05RAm9qSbsKy4UVLDceNn

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668683197

C2

23.240.47.58:995

12.172.173.82:465

91.169.12.198:32100

94.63.65.146:443

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

83.114.60.6:2222

86.171.75.63:443

86.195.32.149:2222

170.253.25.35:443

92.185.204.18:2078

157.231.42.190:995

170.249.59.153:443

174.101.111.4:443

116.74.163.152:443

76.80.180.154:995

180.151.104.143:443

86.130.9.167:2222

86.99.15.243:2222

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      WW.js

    • Size

      9KB

    • MD5

      7805b0885e64e4ab56bbee1e7a42db0b

    • SHA1

      65e523c6adf2957bd898d4c429e70985268e2804

    • SHA256

      c5df8f8328103380943d8ead5345ca9fe8a9d495634db53cf9ea3266e353a3b1

    • SHA512

      2da4423b7fc90c17dabf0307ece416616908d9171cc62865c988f37d8f980817efe30d1dd57b244159c5af4b9ef68bdec1b9b7a3df6c7d50d726f6fac9dac809

    • SSDEEP

      192:juSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:FVq2k785UIro8KTMhSeYm5P2jiuuEjP4

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Target

      port/resemblance.tmp

    • Size

      691KB

    • MD5

      0cffee80be59c6316a7132446b0da699

    • SHA1

      80f524f04ef866cbc871b55f3d7e5786074671a4

    • SHA256

      8ca16991684f7384c12b6622b8d1bcd23bc27f186f499c2059770ddd3031f274

    • SHA512

      ff4d88e5151379cc8429a6e989768788fbb32fa44a954e02ec04f4e46a2ec9fecdccea34ffb7775b7f202275cb61edfdffdf4c9c1b5899885c7bc5df8eb1f469

    • SSDEEP

      12288:sjGfBl7YUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sjk1W8wWpD9u/VLM9Xq4n

MITRE ATT&CK Enterprise v6

Tasks