Overview

overview

10

Static

static

XK59.iso

windows7-x64

3

XK59.iso

windows10-2004-x64

3

WW.js

windows7-x64

10

WW.js

windows10-2004-x64

10

port/ineligibly.dll

windows7-x64

10

port/ineligibly.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XK59.img

  • Size

    848KB

  • Sample

    221118-nsv7cshc46

  • MD5

    9095e01963927b3d9c8d458a5884eb89

  • SHA1

    238efae11e32ebf03c597c491df1d77270e7037f

  • SHA256

    53470a7925f720edbc1233cd22aa87180eadb06a36c7c220f6454b4634ddfb64

  • SHA512

    95acff218657399a9c2e79d0cbbffd504fd272c43ce4347020c2044c9fa664c200617248a25dc573e0de33b5211cfd4af7992132786500994e94a873d31cf3ea

  • SSDEEP

    12288:goTjGfBlKYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9QVN9:goTjkCW8wWpD9u/VLM9Xq4nQVN9

Score
10/10
qakbotbb061668683197bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668683197

C2

23.240.47.58:995

12.172.173.82:465

91.169.12.198:32100

94.63.65.146:443

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

83.114.60.6:2222

86.171.75.63:443

86.195.32.149:2222

170.253.25.35:443

92.185.204.18:2078

157.231.42.190:995

170.249.59.153:443

174.101.111.4:443

116.74.163.152:443

76.80.180.154:995

180.151.104.143:443

86.130.9.167:2222

86.99.15.243:2222
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      XK59.img

    • Size

      848KB

    • MD5

      9095e01963927b3d9c8d458a5884eb89

    • SHA1

      238efae11e32ebf03c597c491df1d77270e7037f

    • SHA256

      53470a7925f720edbc1233cd22aa87180eadb06a36c7c220f6454b4634ddfb64

    • SHA512

      95acff218657399a9c2e79d0cbbffd504fd272c43ce4347020c2044c9fa664c200617248a25dc573e0de33b5211cfd4af7992132786500994e94a873d31cf3ea

    • SSDEEP

      12288:goTjGfBlKYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9QVN9:goTjkCW8wWpD9u/VLM9Xq4nQVN9

    Score
    3/10
    behavioral1behavioral2

    • Target

      WW.js

    • Size

      9KB

    • MD5

      836dd4e66c54a0b87338476692449f95

    • SHA1

      a45cf5554d14c8f52997a6bf5d0edbb3cfd8f0ba

    • SHA256

      b8c7e9000b7b46c6e7082e78b0d2ddcb5580f18f20baa6a88f52ea0f19f9a7bd

    • SHA512

      a879978cc54c6f5cbd082c6b7a29f5aa3c799fb6a67c4a649f4a69fc7e314518707a08990c12e9f281f345ea2f27caa9e0ad3297a079eb76b489f694a7dd03f8

    • SSDEEP

      192:jRSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:oVq2k785UIro8KTMhSeYm5P2jiuuEjP4

    Score
    10/10
    qakbotbb061668683197bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      port/ineligibly.tmp

    • Size

      691KB

    • MD5

      539dadaebe897e1c9b86187c56eeaa53

    • SHA1

      6863953cac4060d35bbf360472b328be952289af

    • SHA256

      fef765bd9702270b59c5219b26d8732e735a092bd1f098c406d99e646d79ea56

    • SHA512

      9f0b27fda0e793d2f6e191e1ec48dd887f18740c2ab124d6ba1badd65d2f8726b0cc9eed05d37dac9c3db436268143b92c5297766ee0f4198526d08ec5604627

    • SSDEEP

      12288:sjGfBlKYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sjkCW8wWpD9u/VLM9Xq4n

    Score
    10/10
    qakbotbb061668683197bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks