Overview

overview

10

Static

static

ZN89.iso

windows7-x64

3

ZN89.iso

windows10-2004-x64

3

WW.js

windows7-x64

10

WW.js

windows10-2004-x64

10

animators/...es.dll

windows7-x64

10

animators/...es.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ZN89.img

  • Size

    970KB

  • Sample

    221118-as7cqsgc27

  • MD5

    9e8d69daed1345c197150ef103a59251

  • SHA1

    b27eab40c99ebc0cbfb6a8c01af7e4ebc64e6c10

  • SHA256

    9020250778de1720c3f97307f58baf9737dcf7af7969fd495e35bf97123f33a2

  • SHA512

    5cbd3d24e90cad2ebac6c06ccb22b2f631fbb51460c40312f8b258b1d138a4455032de7bc76e0eb28c1b7d4f00289a6f7f652fef8b864f8df2df384b016a354d

  • SSDEEP

    12288:noeKwnON76F+DfZxL4+Dir8lkQ5z4hbsmKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:noeKwW6F+DRt4Tr8lkBhgp2QOUZ

Score
10/10
qakbotbb061668670510bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668670510

C2

86.225.214.138:2222

71.183.236.133:443

182.66.197.35:443

70.66.199.12:443

76.80.180.154:995

180.151.104.143:443

92.149.205.238:2222

83.110.223.247:443

183.87.31.34:443

105.103.50.1:990

103.141.50.117:995

105.103.50.1:465

105.103.50.1:22

86.130.9.167:2222

86.99.15.243:2222

90.104.22.28:2222

172.117.139.142:995

176.142.207.63:443

142.161.27.232:2222

71.247.10.63:50003
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      ZN89.img

    • Size

      970KB

    • MD5

      9e8d69daed1345c197150ef103a59251

    • SHA1

      b27eab40c99ebc0cbfb6a8c01af7e4ebc64e6c10

    • SHA256

      9020250778de1720c3f97307f58baf9737dcf7af7969fd495e35bf97123f33a2

    • SHA512

      5cbd3d24e90cad2ebac6c06ccb22b2f631fbb51460c40312f8b258b1d138a4455032de7bc76e0eb28c1b7d4f00289a6f7f652fef8b864f8df2df384b016a354d

    • SSDEEP

      12288:noeKwnON76F+DfZxL4+Dir8lkQ5z4hbsmKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:noeKwW6F+DRt4Tr8lkBhgp2QOUZ

    Score
    3/10
    behavioral1behavioral2

    • Target

      WW.js

    • Size

      9KB

    • MD5

      bcb9892b516c84743679ae3e5b7b140b

    • SHA1

      de8535bf66f297607d1e396f0dffec1c08cacbf1

    • SHA256

      4884dbd1e84c7c42f08a3835f6ea3b6d7f4833335df7c207da8547a2de6be527

    • SHA512

      24b75fa4febd9af33d3f58f99cf05527d6842ec32bc47ccf673281d1acf7d6e1a5caf010a7106ab3b3b89bea9c13f3f591d742cade8505d96adb2ed39e721b70

    • SSDEEP

      192:NSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:oVq2k785UIro8KTMhSeYm5P2jiuuEjP4

    Score
    10/10
    qakbotbb061668670510bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      animators/participates.tmp

    • Size

      835KB

    • MD5

      d06e0e54a6d4c8a7996f1e2619f1efdf

    • SHA1

      d689846c783af6786748dce785a422aaeb73bb6c

    • SHA256

      ed974b2b9e7dd9d96977e605f474f3ba8cfa4b1dbc9f12bbfabda9e06c7b39a7

    • SHA512

      1323e002dbeffd6a8ca50b9e0f697d1a783c3fcc7315666f26ce5fd3100a4b9b575d480e6da02cfd73191e5b804c969c3e176bd16dc229561549463cf1dd9c38

    • SSDEEP

      12288:T6F+DfZxL4+Dir8lkQ5z4hbsmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:T6F+DRt4Tr8lkBhgp2QOU

    Score
    10/10
    qakbotbb061668670510bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks