Overview

overview

10

Static

static

02e46d72ba...d.html

windows7-x64

1

02e46d72ba...d.html

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02e46d72ba920ff53a88448da10c757d.zip

  • Size

    457KB

  • Sample

    221118-vbk4dsdg8v

  • MD5

    042285228a46df4903d73df30f67f7d1

  • SHA1

    550c51b5e15ab711de706261f0139150b9d947fe

  • SHA256

    bad3b84f51b80498dba4d8c9b63bfbad704c85392d26562643bf693b298d74f5

  • SHA512

    f49259a8eaa893b05c223f8233bc45af62772d76647451900e8b07ecaff54dcd3807e4b9923f85b3b54c5e709111137bc61d7992c70d1afd1fe38876d0b5bd84

  • SSDEEP

    12288:0wanQeyul7Ln9PeXQmpZJalwGrawdGdd8mN:K39WxHJalqnd8O

Score
10/10
qakbotobama2231668757345bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama223

Campaign

1668757345

C2

68.47.128.161:443

87.65.160.87:995

172.90.139.138:2222

86.175.128.143:443

12.172.173.82:465

71.247.10.63:2083

47.41.154.250:443

91.254.215.167:443

71.31.101.183:443

81.229.117.95:2222

24.4.239.157:443

41.99.177.175:443

92.149.205.238:2222

73.230.28.7:443

47.229.96.60:443

186.188.2.193:443

174.112.25.29:2078

84.35.26.14:995

86.130.9.167:2222

116.74.163.221:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      02e46d72ba920ff53a88448da10c757d

    • Size

      637KB

    • MD5

      02e46d72ba920ff53a88448da10c757d

    • SHA1

      251f82d31b229995a258b98f8b5e9cc593bb7cc7

    • SHA256

      4520b59b551a5d81887d812054e098d38588e5b894e26004da51ba015d8bda1f

    • SHA512

      dbb4f792832a07d196d1a40e681cece6fc230da24fc2ad107b2e7dbc7caa0b7e59d25af1cd9e0d0997614b60a2a6c796c4742200e1fa64bafb5e206337f78d5d

    • SSDEEP

      12288:ZIvXncjpQ903U42e+6VMpEmKszfchQBZZC09P+Xk:mCUM+PKrhQtC0c0

    Score
    10/10
    qakbotobama2231668757345bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks