Overview

overview

10

Static

static

YP14.iso

windows7-x64

3

YP14.iso

windows10-2004-x64

3

WW.js

windows7-x64

10

WW.js

windows10-2004-x64

10

port/venice.dll

windows7-x64

10

port/venice.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    YP14.img

  • Size

    848KB

  • Sample

    221117-tvb46aah6x

  • MD5

    57a36aafbe4de39042835b14c73ded1f

  • SHA1

    2a8e9c4b47e1bde63cefaafda2f4abfb5c3f54da

  • SHA256

    93b986f9501a62923947e187b2febf54aa5fc84e411072272996b2d3437ee4a7

  • SHA512

    ce73786cb69e0f2e7401a9a4d698efc29c6973b4046cfc23cc841d00b982364a662413710442c87df9436a64a40b4d59b43c20365f589cb11d31a9df4a719415

  • SSDEEP

    12288:FoZVN9gjGfBltYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:FoZVN9gjkfW8wWpD9u/VLM9Xq4n

Score
10/10
qakbotbb061668683197bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668683197

C2

23.240.47.58:995

12.172.173.82:465

91.169.12.198:32100

94.63.65.146:443

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

83.114.60.6:2222

86.171.75.63:443

86.195.32.149:2222

170.253.25.35:443

92.185.204.18:2078

157.231.42.190:995

170.249.59.153:443

174.101.111.4:443

116.74.163.152:443

76.80.180.154:995

180.151.104.143:443

86.130.9.167:2222

86.99.15.243:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      YP14.img

    • Size

      848KB

    • MD5

      57a36aafbe4de39042835b14c73ded1f

    • SHA1

      2a8e9c4b47e1bde63cefaafda2f4abfb5c3f54da

    • SHA256

      93b986f9501a62923947e187b2febf54aa5fc84e411072272996b2d3437ee4a7

    • SHA512

      ce73786cb69e0f2e7401a9a4d698efc29c6973b4046cfc23cc841d00b982364a662413710442c87df9436a64a40b4d59b43c20365f589cb11d31a9df4a719415

    • SSDEEP

      12288:FoZVN9gjGfBltYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:FoZVN9gjkfW8wWpD9u/VLM9Xq4n

    Score
    3/10
    behavioral1behavioral2

    • Target

      WW.js

    • Size

      9KB

    • MD5

      7aa6ff9bbec4101066b098ef2fb09063

    • SHA1

      9d2b4dc5ce48bc06c6bcdecf93fa18c2a85eeb7b

    • SHA256

      7d8ca6f2521f131688a38b3de7ba51fa36abe81b89ed8ab453192d39a05bfb19

    • SHA512

      22f98b30fa4b1170b0de98b5133d8da3cac0bb01a3def3e9f53aa77c57c6d7e588dc8ee6d331f50f559227bb0adb56f5f30de44256f5659a2e6c4f5436fdd142

    • SSDEEP

      192:jfSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:6Vq2k785UIro8KTMhSeYm5P2jiuuEjP4

    Score
    10/10
    qakbotbb061668683197bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      port/venice.tmp

    • Size

      691KB

    • MD5

      19f27d9e868a2964d303487cdb3a5a24

    • SHA1

      0662a2de5ea98c2471ba1642ea67c52378cfb819

    • SHA256

      c57464520ddea4183c47d3925bacf08e836add208b9443a7793a951f04f1dc62

    • SHA512

      478c16ef1a71646898fb8fc2a0700d88b02e27e5e8d092dbd2fb99bbf43d14d0241318095815a072f421b19a5ec6efc76db80b881afd60f10d70e94eb856712b

    • SSDEEP

      12288:sjGfBltYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sjkfW8wWpD9u/VLM9Xq4n

    Score
    10/10
    qakbotbb061668683197bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks