Overview

overview

10

Static

static

WP.vbs

windows7-x64

10

WP.vbs

windows10-2004-x64

10

metaphysic...an.ps1

windows7-x64

1

metaphysic...an.ps1

windows10-2004-x64

1

metaphysic...nt.vbs

windows7-x64

3

metaphysic...nt.vbs

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    YA-148WP.iso

  • Size

    101.2MB

  • Sample

    221130-vyx2gadc7s

  • MD5

    9a56a5479afb3721c25b94bcc1ce444b

  • SHA1

    8096d4cf5cfe4f9bfcda56e2aa061ae40b461691

  • SHA256

    caf5d3e8d6a04eecfe3cc0df03b1fd5ce7dd5568be4010c89ca9311692eafd9e

  • SHA512

    83dc9024a19a89e63128da440e4ab96b5c79869ab2090820e0e7a35d16e53e2cf710f2cc367f79feba48dc44719a1d9cb6f8391fb647724f0f0b6719c15c2b32

  • SSDEEP

    24576:YFolOZ7iw5ywfHH3vwLwZ0RV9Z0OEdMd2z52kqAaBJP8fnLJ518VCqoI2y7HE:YFolOZ7iw5ywfHH3vwLwOuDHqHE

Score
10/10
qakbotobama2241669794048bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama224

Campaign

1669794048

C2

75.161.233.194:995

216.82.134.218:443

174.104.184.149:443

173.18.126.3:443

87.202.101.164:50000

172.90.139.138:2222

184.153.132.82:443

185.135.120.81:443

24.228.132.224:2222

87.223.84.190:443

178.153.195.40:443

24.64.114.59:2222

77.126.81.208:443

75.99.125.235:2222

173.239.94.212:443

98.145.23.67:443

109.177.245.176:2222

72.200.109.104:443

12.172.173.82:993

82.11.242.219:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      WP.vbs

    • Size

      188B

    • MD5

      3deb84abc5eea7ba97c49a0d395e266c

    • SHA1

      8b188dc6b9a1453e610cda650016989173996d30

    • SHA256

      988ae45b60b696db93e7e2e97c9ab4bfd774c6540b6058ade03e9f6969e7c903

    • SHA512

      dbc7b0ddce34aae5f9c717b927caf4feb417a900f1d20392fccc3ae6a4ff08793aa23253d2ad013fab6714c7e987b3ec23ca4f274ca827f830cba91317531a36

    Score
    10/10
    qakbotobama2241669794048bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      metaphysic/sesquipedalian.ps1

    • Size

      367B

    • MD5

      de78ba4cd9c3ebc83d5ba3f2dc0855cb

    • SHA1

      b28711d0428cab4f2f291037593a7d1d845fa707

    • SHA256

      aed952f392e5b68d987e2d20994b02b5a703e283bda443d2d84a7ad7c2f0156e

    • SHA512

      5c1df6503a4f04e90c16d827737794301c00b3833f521770901e5643e16910653cb8ee67eea9aeea172dbf00d3d41482c183c0465f47d5cddad5024a81d14f70

    Score
    1/10
    behavioral3behavioral4

    • Target

      metaphysic/vigilant.vbs

    • Size

      188B

    • MD5

      3deb84abc5eea7ba97c49a0d395e266c

    • SHA1

      8b188dc6b9a1453e610cda650016989173996d30

    • SHA256

      988ae45b60b696db93e7e2e97c9ab4bfd774c6540b6058ade03e9f6969e7c903

    • SHA512

      dbc7b0ddce34aae5f9c717b927caf4feb417a900f1d20392fccc3ae6a4ff08793aa23253d2ad013fab6714c7e987b3ec23ca4f274ca827f830cba91317531a36

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks