Resubmissions

30-11-2022 01:54

221130-cbzbxabf7s 10

30-11-2022 01:33

221130-bykllafc86 1

General

  • Target

    b5ac0c29-5792-4494-b1da-39e24a1305f2.html

  • Size

    635KB

  • Sample

    221130-cbzbxabf7s

  • MD5

    ed71cd00d8d5828af0f009cb416b5f29

  • SHA1

    a0a4dfee1827ebc7cbd9cd4b3d65b4af4523bb85

  • SHA256

    75b86b1c8506479e325adef0d1709fe1085d18412735801382794bfaa11d673b

  • SHA512

    06f0060c25653c84a2f7b8bf09a5c1ebe2de1dc6bd4fed9ff42892a950e972e7cff39a9c9fd638d7ce7acc975ca7c9b12674a57ff49b10ef71fbc8f2c9dfc282

  • SSDEEP

    12288:4K6CzXEideCJbodCmGqbBtfWr13NCpEK3XoXtYStXtb:+Cz0ikqEdCWtfNpX4XuGXl

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama223

Campaign

1668757345

C2

68.47.128.161:443

87.65.160.87:995

172.90.139.138:2222

86.175.128.143:443

12.172.173.82:465

71.247.10.63:2083

47.41.154.250:443

91.254.215.167:443

71.31.101.183:443

81.229.117.95:2222

24.4.239.157:443

41.99.177.175:443

92.149.205.238:2222

73.230.28.7:443

47.229.96.60:443

186.188.2.193:443

174.112.25.29:2078

84.35.26.14:995

86.130.9.167:2222

116.74.163.221:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      b5ac0c29-5792-4494-b1da-39e24a1305f2.html

    • Size

      635KB

    • MD5

      ed71cd00d8d5828af0f009cb416b5f29

    • SHA1

      a0a4dfee1827ebc7cbd9cd4b3d65b4af4523bb85

    • SHA256

      75b86b1c8506479e325adef0d1709fe1085d18412735801382794bfaa11d673b

    • SHA512

      06f0060c25653c84a2f7b8bf09a5c1ebe2de1dc6bd4fed9ff42892a950e972e7cff39a9c9fd638d7ce7acc975ca7c9b12674a57ff49b10ef71fbc8f2c9dfc282

    • SSDEEP

      12288:4K6CzXEideCJbodCmGqbBtfWr13NCpEK3XoXtYStXtb:+Cz0ikqEdCWtfNpX4XuGXl

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Tasks