General

  • Target

    WI34.img

  • Size

    970KB

  • Sample

    221118-bw7cksgc57

  • MD5

    c183d13389f1e6418b6992e717d8cb68

  • SHA1

    8461fd13a2f5986fbdca62dcb6870f6bf0cfec91

  • SHA256

    a9667421d92708fdeda118f75916afd6a904fbcf2ba85c1fd7d41d14021137b9

  • SHA512

    7da9ecde9b0d3f00faff43bf73db25aaa1fb0cba5ed55cffd37bd07c7a4630f8dc033b7c4689c4ec92255ff1c81eeb043bd71219b5692560059d08b319c1e53e

  • SSDEEP

    12288:xouKwnONVvoo6F+DfZxL4+Dir8lkQ5z4hbDmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:xouKw9o6F+DRt4Tr8lkBhPp2QOU

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668670510

C2

86.225.214.138:2222

71.183.236.133:443

182.66.197.35:443

70.66.199.12:443

76.80.180.154:995

180.151.104.143:443

92.149.205.238:2222

83.110.223.247:443

183.87.31.34:443

105.103.50.1:990

103.141.50.117:995

105.103.50.1:465

105.103.50.1:22

86.130.9.167:2222

86.99.15.243:2222

90.104.22.28:2222

172.117.139.142:995

176.142.207.63:443

142.161.27.232:2222

71.247.10.63:50003

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      WI34.img

    • Size

      970KB

    • MD5

      c183d13389f1e6418b6992e717d8cb68

    • SHA1

      8461fd13a2f5986fbdca62dcb6870f6bf0cfec91

    • SHA256

      a9667421d92708fdeda118f75916afd6a904fbcf2ba85c1fd7d41d14021137b9

    • SHA512

      7da9ecde9b0d3f00faff43bf73db25aaa1fb0cba5ed55cffd37bd07c7a4630f8dc033b7c4689c4ec92255ff1c81eeb043bd71219b5692560059d08b319c1e53e

    • SSDEEP

      12288:xouKwnONVvoo6F+DfZxL4+Dir8lkQ5z4hbDmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:xouKw9o6F+DRt4Tr8lkBhPp2QOU

    Score
    3/10
    • Target

      WW.js

    • Size

      9KB

    • MD5

      558430d02887b5a840b78776f13fceda

    • SHA1

      8d632f98ed740405eefbf6ea6c0f8b320df2a1e6

    • SHA256

      cff806496c39381fea28ea2a501c669ca8aada38dfa9b37ee13a7ed206ef4e63

    • SHA512

      9555f8565ef810e296f0469e272758f6f4739983dd8ecd258239a76b0b7e001cbd06957b6d0eb84fde07a99648062db613ab34c5229d714f88a0d97c7951f27d

    • SSDEEP

      192:SSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:9Vq2k785UIro8KTMhSeYm5P2jiuuEjP4

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Target

      animators/valuable.tmp

    • Size

      835KB

    • MD5

      3923dda28248cab18c1d1a223b039f47

    • SHA1

      1263d839f8ab476b93b606e1227b7b35c6ae1d7d

    • SHA256

      5efab4e49bac08d9cb062010a9385369aa16bf6970fd1338d02ecfea1b93c52a

    • SHA512

      8b7c4da763acc3b587846f8dbac26a0885ab53b86f4bf5bb11a4a76d9c9ee71e58783e69489df06856ca342996e5716ffc98fc4dc7aa969ea990a900e1167905

    • SSDEEP

      12288:T6F+DfZxL4+Dir8lkQ5z4hbDmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:T6F+DRt4Tr8lkBhPp2QOU

MITRE ATT&CK Enterprise v6

Tasks