Overview

overview

10

Static

static

Agreement.js

windows10-2004-x64

10

data.txt

windows10-2004-x64

1

debunked/dustbins.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Agreement_OSN37.iso

  • Size

    662KB

  • Sample

    221118-1js2vshf62

  • MD5

    00891d49f4809e34bf8ceda532df79db

  • SHA1

    a99db05d0f56ee109311922a90a4eddbdfb3aafa

  • SHA256

    6e8cbe52474b6ed2c56b747faa4c525940ff2646b8a660b3668bc85c7c0a48e8

  • SHA512

    c595442f129acfed79db32e779215be41d574096eda331343a46252810de3eba4433438848db209837f7676112387950650c18cf36df672a5d6ae04ede27f0d8

  • SSDEEP

    12288:3Nb6E1YF7P01JSdCLjqa/9HNdMxgligH8QLxwOQH:3Nb6VP0/Ssfh9HUMFLxSH

Score
10/10
qakbotobama2231668757345bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama223

Campaign

1668757345

C2

68.47.128.161:443

87.65.160.87:995

172.90.139.138:2222

86.175.128.143:443

12.172.173.82:465

71.247.10.63:2083

47.41.154.250:443

91.254.215.167:443

71.31.101.183:443

81.229.117.95:2222

24.4.239.157:443

41.99.177.175:443

92.149.205.238:2222

73.230.28.7:443

47.229.96.60:443

186.188.2.193:443

174.112.25.29:2078

84.35.26.14:995

86.130.9.167:2222

116.74.163.221:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Agreement.js

    • Size

      9KB

    • MD5

      ee3eccd60f6fd7f0f9aa5a48cdfc1765

    • SHA1

      27d716e6c077b8bf38942eafee647146b87aa5b5

    • SHA256

      6c92852615b0dd5dd922c0db11fdfcdd85330ff20707ce1128f841e06ab530d4

    • SHA512

      1effb8b1ddcf2d45dc54fb38d36e836eced44ff58e3078c37cd48a61afdeae6bd106c4f515988aa8a6d597360cbd0048710ac65d56e931659353dcb9bae18de8

    • SSDEEP

      192:/3SLj5Uravgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5AJ:/O5Kk785UIhp/KTMhSeYmn2jiu5EjP+I

    Score
    10/10
    qakbotobama2231668757345bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1

    • Target

      data.txt

    • Size

      5B

    • MD5

      bb692cc1e32054c2aa0ec80111dee5ef

    • SHA1

      223bae19990c7398a55a7963ef239ca54c30f5ca

    • SHA256

      5bbeb671347ca2e15fb64d618eb618d53d16f3d13507d1013cc0640afe212282

    • SHA512

      acdb2796ff1ce68f1d3cc71a3058825c6a7c1d12ce1e0ef3341bfb3cb3e57cf2bd50b06160cc68b87e6349990606f146711a7907f2f4353c37f91afd923c11a6

    Score
    1/10
    behavioral2

    • Target

      debunked/dustbins.temp

    • Size

      374KB

    • MD5

      bf30bf20090c91b60c22f473fa0e276f

    • SHA1

      e6a77f68a4fa60c06e9a6f68778906c62dd80b36

    • SHA256

      0aee5dc39881632395a00aeb636e99bcd229a0995cfbbdf7de26fe4c81167b01

    • SHA512

      9fd1a1dbae6b736137e33f76fcd08554a8dbc1faab3929d875564a9d5f03990490d13868eb381406eca87ded97be1a8e5911183b45a028badadd1d281a2ce5c6

    • SSDEEP

      6144:XKR66t98Uah1oq7PbQIIJSLiyCE0taaRIC6w/9IfFK+20m6WdMxgYURpi92H4X:w6E1YF7P01JSdCLjqa/9HNdMxgligH8

    Score
    10/10
    qakbotobama2231668757345bankerstealertrojan
    behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks