Overview

overview

10

Static

static

SX45.iso

windows7-x64

3

SX45.iso

windows10-2004-x64

3

WW.js

windows7-x64

10

WW.js

windows10-2004-x64

10

port/revolution.dll

windows7-x64

10

port/revolution.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SX45.img

  • Size

    848KB

  • Sample

    221118-j6958acg8z

  • MD5

    796a11d76347e917680acc31f7349e88

  • SHA1

    4f327071d02171241245612aa57921c589afe410

  • SHA256

    9f090c29601ba885046be32e77f4f8255f2d8b16440e018a0e17e392e0e1bcf5

  • SHA512

    f20618497214da2207922ee23c3c82f529661e65d3d6d55fcac00857b4b829418d89d48b1037240289670e68f2a715cc27e1cb07b62ed8162d03c2bb9d9f8d40

  • SSDEEP

    12288:toJVN9gjGfBlJYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:toJVN9gjk7W8wWpD9u/VLM9Xq4n

Score
10/10
qakbotbb061668683197bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668683197

C2

23.240.47.58:995

12.172.173.82:465

91.169.12.198:32100

94.63.65.146:443

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

83.114.60.6:2222

86.171.75.63:443

86.195.32.149:2222

170.253.25.35:443

92.185.204.18:2078

157.231.42.190:995

170.249.59.153:443

174.101.111.4:443

116.74.163.152:443

76.80.180.154:995

180.151.104.143:443

86.130.9.167:2222

86.99.15.243:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      SX45.img

    • Size

      848KB

    • MD5

      796a11d76347e917680acc31f7349e88

    • SHA1

      4f327071d02171241245612aa57921c589afe410

    • SHA256

      9f090c29601ba885046be32e77f4f8255f2d8b16440e018a0e17e392e0e1bcf5

    • SHA512

      f20618497214da2207922ee23c3c82f529661e65d3d6d55fcac00857b4b829418d89d48b1037240289670e68f2a715cc27e1cb07b62ed8162d03c2bb9d9f8d40

    • SSDEEP

      12288:toJVN9gjGfBlJYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:toJVN9gjk7W8wWpD9u/VLM9Xq4n

    Score
    3/10
    behavioral1behavioral2

    • Target

      WW.js

    • Size

      9KB

    • MD5

      ba9e6d72c13c5cdd2d20a36733768f16

    • SHA1

      15924060325b75069714e2af7b9ffa3a99fc76f6

    • SHA256

      2baa1b97a40e58aa588ee2561aed8245fbaeddddac676d67a35bec852aa136f4

    • SHA512

      39728518da79bbd27aa941571b9a83675f7d6d4cdfa82142bc5ad3ca052c8a3f8d11da20cefadefbe235d7b9bb8199b17651ce04e3fc22e0a73bf7ac7ce44f77

    • SSDEEP

      192:jgSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:DVq2k785UIro8KTMhSeYm5P2jiuuEjP4

    Score
    10/10
    qakbotbb061668683197bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      port/revolution.tmp

    • Size

      691KB

    • MD5

      0e4a77bf82911bc17023408cca2edbda

    • SHA1

      4979c852b6792a0cbbfdfc766864b5eafdd5716c

    • SHA256

      8ae878effceb1a76ba103550970b27662a0328c00bd0fb8b8d7e78750c0f3b65

    • SHA512

      4d3b2d11d154bb5db2c69341542f9aeebfd10ee123f419c6f9119160824821600c3a86333987a8b93cb50e6bf5f90333cfdcd4da38446e2f47cb25d0f7eb0758

    • SSDEEP

      12288:sjGfBlJYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sjk7W8wWpD9u/VLM9Xq4n

    Score
    10/10
    qakbotbb061668683197bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks