Overview

overview

10

Static

static

JG.js

windows7-x64

10

JG.js

windows10-2004-x64

10

almond/lemur.dll

windows7-x64

10

almond/lemur.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    QXL26.iso
  • Size 604KB
  • Sample221121-pv75daeb7s
  • SHA256 4c8e89fcad82ff8b2b6bba0626caf43e8e7e776718f053fc50c256ae9fa35f70
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
qakbotbb071669024152bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 404.30

Botnet

  • BB07

Campaign

  • 1669024152

C2

  • 69.119.123.159:2222

  • 197.148.17.17:2078

  • 174.104.184.149:443

  • 12.172.173.82:995

  • 91.68.227.219:443

  • 85.241.180.94:443

  • 83.7.53.150:443

  • 213.22.188.57:2222

  • 71.46.234.170:443

  • 190.75.150.58:2222

  • 86.98.15.100:995

  • 89.115.196.99:443

  • 83.31.254.67:2222

  • 46.162.109.183:443

  • 2.84.98.228:2222

  • 78.69.251.252:2222

  • 12.172.173.82:465

  • 75.143.236.149:443

  • 47.229.96.60:443

  • 80.121.8.212:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target
      JG.js
    • Size 10KB
    • SHA256 3b00174d5b42adf5da7fe896ce8baae14d67c52f79c49eed82bdf87e3a28d625
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    qakbotbb071669024152bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2
    • Target
      almond/lemur.temp
    • Size 490KB
    • SHA256 3c0c4314624497645c426ed6e9fbfd37042f7aceb51e60a894135ea4a42851c0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    qakbotbb071669024152bankerstealertrojan
    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks