Overview

overview

10

Static

static

Agreement.js

windows7-x64

10

Agreement.js

windows10-2004-x64

10

debunked/c...ve.dll

windows7-x64

10

debunked/c...ve.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Agreement_YBZ45.iso

  • Size

    662KB

  • Sample

    221118-yb3vzshg8x

  • MD5

    071a82fee2f3845d21385b1a5a7beef4

  • SHA1

    d00e619f7e25ada00da1324f2f5b596a77a5f974

  • SHA256

    017af445ace67de1c8b1dfe7427d37b8e0aba69827968e820149b76bae1e2925

  • SHA512

    921b15522c552816f08ec16b86530056e1353eaa6a698e35e9ba3451bb870d9570040edc6d1278692a329cc9803ad01de0b634a34da16cd568df8f034660dbf9

  • SSDEEP

    12288:7Nv6E1YF7P01JSdCLjqa/9ONdMxgligH8QLxwOQH:7Nv6VP0/Ssfh9OUMFLxSH

Score
10/10
qakbotobama2231668757345bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama223

Campaign

1668757345

C2

68.47.128.161:443

87.65.160.87:995

172.90.139.138:2222

86.175.128.143:443

12.172.173.82:465

71.247.10.63:2083

47.41.154.250:443

91.254.215.167:443

71.31.101.183:443

81.229.117.95:2222

24.4.239.157:443

41.99.177.175:443

92.149.205.238:2222

73.230.28.7:443

47.229.96.60:443

186.188.2.193:443

174.112.25.29:2078

84.35.26.14:995

86.130.9.167:2222

116.74.163.221:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Agreement.js

    • Size

      9KB

    • MD5

      7f21740891357967e66d0b4760d88b7d

    • SHA1

      842d4dd71a3cd875e1a3ba9c0942e7a46fa67e53

    • SHA256

      e58923b374ae3b3e28e392d16cc59d29fd4f9d309c84b141cd18c2ee94c0cf40

    • SHA512

      10aaa2d9772e93a4b8ed7add7919a99803a6017284b405953826d2de4be7f6073c529a1d523e67831ef8ebff4df458808efbaa178b04a1e999717f8ec1c0265d

    • SSDEEP

      192:/5SLj5Uravgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5AJ:/E5Kk785UIhp/KTMhSeYmn2jiu5EjP+I

    Score
    10/10
    qakbotobama2231668757345bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

    • Target

      debunked/commutative.temp

    • Size

      374KB

    • MD5

      3b3b0b2efd59eb1d0dd2655f36a3afc4

    • SHA1

      09e317d0b3ef42771bbbbb40d99d6e740f73fb7e

    • SHA256

      282bc9b38457cba003c8f80751e9d1a9aa410c5e245ef3666ad48937a8063e6d

    • SHA512

      5dd89407375265a646b7aa889669b161172eada2e8220cec7ce6f7f5479bf60ded55c8061e034f6f4e0e7c077937cbffaa8921264e5b7c6f4d08b4a1bd9c6fef

    • SSDEEP

      6144:XKR66t98Uah1oq7PbQIIJSLiyCE0taaRIC6w/9I+FK+20m6WdMxgYURpi92H4X:w6E1YF7P01JSdCLjqa/9ONdMxgligH8

    Score
    10/10
    qakbotobama2231668757345bankerstealertrojan
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks