Overview

overview

10

Static

static

WP.vbs

windows7-x64

10

WP.vbs

windows10-2004-x64

10

metaphysic/dates.vbs

windows7-x64

3

metaphysic/dates.vbs

windows10-2004-x64

7

metaphysic...an.ps1

windows7-x64

1

metaphysic...an.ps1

windows10-2004-x64

1

Resubmissions

09-12-2022 21:31

221209-1c7lnsed59 10

01-12-2022 01:51

221201-b99d4ade82 10

01-12-2022 01:46

221201-b7b1tagf7t 3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WT-163WP.iso

  • Size

    101.2MB

  • Sample

    221209-1c7lnsed59

  • MD5

    b650be9066248fd19bf55295a3dd91c1

  • SHA1

    08dbe772979f2cf9b70637ecb4fbed0a29517b4a

  • SHA256

    ad914a64e27ceb65f105dda2b9333507503acf7b5dfa24dcaf0eebed70e10c9b

  • SHA512

    cd2dbb0d4addb80ff59126febd145b6a127378a6eadb18bdc3bffe8eab54b2db71352920c12be1882df88aa2eb8bd5b1d3b38124a4d607fabfd4194f380c3aaf

  • SSDEEP

    24576:xFolOZ7iwCywfHH3vwLwZ0RV9Z0OEdMddz52kqAaBJP8fnLJ518VCqoI2ytH2:xFolOZ7iwCywfHH3vwLwDuDHAH2

Score
10/10
qakbotobama2241669794048bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama224

Campaign

1669794048

C2

75.161.233.194:995

216.82.134.218:443

174.104.184.149:443

173.18.126.3:443

87.202.101.164:50000

172.90.139.138:2222

184.153.132.82:443

185.135.120.81:443

24.228.132.224:2222

87.223.84.190:443

178.153.195.40:443

24.64.114.59:2222

77.126.81.208:443

75.99.125.235:2222

173.239.94.212:443

98.145.23.67:443

109.177.245.176:2222

72.200.109.104:443

12.172.173.82:993

82.11.242.219:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      WP.vbs

    • Size

      184B

    • MD5

      5a64a9a56d44ed92dc9cd3273cd94d0a

    • SHA1

      da0e818b31aec9495fa23a0f2ae2af90997dce36

    • SHA256

      23310085830cdfc806ca51497c1bda64a477adc14769bfc814d61013bb4719d0

    • SHA512

      bf2350639475e6fdc75d59c937b7f49e58506ebd082a16376b353c5ea02547c0ca9366b234a5a1ea7c5bba017416828a21c02d46577a405f85e628f3a0f198dc

    Score
    10/10
    qakbotobama2241669794048bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      metaphysic/dates.vbs

    • Size

      184B

    • MD5

      5a64a9a56d44ed92dc9cd3273cd94d0a

    • SHA1

      da0e818b31aec9495fa23a0f2ae2af90997dce36

    • SHA256

      23310085830cdfc806ca51497c1bda64a477adc14769bfc814d61013bb4719d0

    • SHA512

      bf2350639475e6fdc75d59c937b7f49e58506ebd082a16376b353c5ea02547c0ca9366b234a5a1ea7c5bba017416828a21c02d46577a405f85e628f3a0f198dc

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      metaphysic/theologian.ps1

    • Size

      370B

    • MD5

      7772115e8a64f8023e03d31a0f5d7c30

    • SHA1

      9b56c67ba011fd46403a1d1a8ab6dc96ff6db804

    • SHA256

      6583a240b2a6d4d06e0ce9e2c3e96ee7f6ebc007893bfa4ba855e6ce974bc47f

    • SHA512

      9d597473ec51fce48cc4e65c6ceb4ece2d47ce665ed2747dc816eaecf94d399624193f1916d6a0a3db4eead21bd55987654e586863a4dfd4f86aa1f38d9e3f93

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

5
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks