Overview

overview

10

Static

static

SCANS_ED7476.lnk

windows7-x64

10

SCANS_ED7476.lnk

windows10-2004-x64

10

YouContrac...on.cmd

windows7-x64

10

YouContrac...on.cmd

windows10-2004-x64

10

YouContrac...es.dll

windows7-x64

10

YouContrac...es.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SCANS_ED7476.img

  • Size

    1.0MB

  • Sample

    221210-p64akafe83

  • MD5

    2f62854f558513f7740873420658892c

  • SHA1

    f326340cdf4c601cf4cb33349a84439ab176828c

  • SHA256

    7f758b8a7adc98eebae7ccb58586586b42c08fbc42bc66a2af71831ab0363c1b

  • SHA512

    b2b0ed3c56c710439b2476135b585359e02a19d04ed6ac1b19771187e2dcc23f40d47160ca9b694f81b8747e18d56d0da30764d81ca67058426edd6b159a02d2

  • SSDEEP

    24576:4f8OQg2uysCV3ZJ4y+Y0BEnwirn0dKMdn8ySZTn7ni2u0mwFIqJ6:4xQpuyd/PuMvY

Score
10/10
qakbotazd1670585125bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

azd

Campaign

1670585125

C2

172.90.139.138:2222

90.116.219.167:2222

173.239.94.212:443

91.169.12.198:32100

74.66.134.24:443

66.191.69.18:995

182.75.189.42:995

78.69.251.252:2222

98.145.23.67:443

103.71.21.107:443

197.94.219.133:443

91.68.227.219:443

12.172.173.82:993

86.176.83.127:2222

64.121.161.102:443

41.98.21.114:443

92.154.17.149:2222

151.65.67.211:443

89.129.109.27:2222

76.11.14.249:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      SCANS_ED7476.lnk

    • Size

      1KB

    • MD5

      ec2ac1e8da4b9930358601c25518570a

    • SHA1

      69ae15e18ae0d277bcf740b59e138dc1c7ae6b73

    • SHA256

      ad1dbb7757e37cce274e096f0970212e858d2e338772f276d2479b18d7bc52f8

    • SHA512

      9f52e7d36d3a2e4de175fda4575758ce9da8f89e781161bae4a2e364bacb5b549744fa25f9bf0282adf6c323523ee352284a3bc7af3bea890fcdea812e086aa5

    Score
    10/10
    qakbotazd1670585125bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

    • Target

      YouContract/RecentInformation.cmd

    • Size

      9KB

    • MD5

      c415428943d6ae9df3ddf926be29f31e

    • SHA1

      c0c8057c59a80112d4e72a99c052e28bb017422a

    • SHA256

      131ef57ff1b1c67d51391ad238a9fe9507032d8e82a315a042fccbfc06b95b2e

    • SHA512

      5c1141c2c79aa93718f8555603067ce317fb64bae94e916310a062e78aae142ac549a54ef8816536687a797121d233998a0dffdf36201625107c6ea4cc3f9d8e

    • SSDEEP

      192:Crn0dKaEYw6Nndn8FkSUzUeHYNWqTJn7ami2u0mwoIWfF4J6e1:Crn0dKajNdn8ySUzUTn7ni2u0mwFIqJL

    Score
    10/10
    qakbotazd1670585125bankerstealertrojan
    behavioral3behavioral4

    • Target

      YouContract/YouNewRules.get

    • Size

      683KB

    • MD5

      3c359f052ab36b9a2dc3c295065a18a0

    • SHA1

      eaaa009b3a42ea965dd55d525e38ce40d30e4069

    • SHA256

      c2818a0dde04b70ce0f01342df88b2d01c2ab0fced4e94fdc1254bf505325bf6

    • SHA512

      c440d7a35870cb17c0a60d99ec9b9dad0fc226162bbd21c11642d4f66f4c77a44882b5b89fe46628031fdedccdc0f253fcfc0479e934664827dd0745a6152db6

    • SSDEEP

      12288:2BZFJonOQg2uym3Fkz1ee5MJ4XpJ5g7x4BdqEz6QQBGPpBi1fn:6f8OQg2uysCV3ZJ4y+Y0BEnwn

    Score
    10/10
    qakbotazd1670585125bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks