Overview

overview

10

Static

static

SCANS_ED7476.lnk

windows7-x64

10

SCANS_ED7476.lnk

windows10-2004-x64

10

YouContrac...on.cmd

windows7-x64

10

YouContrac...on.cmd

windows10-2004-x64

10

YouContrac...es.dll

windows7-x64

10

YouContrac...es.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SCANS_ED7476.rar

  • Size

    358KB

  • Sample

    221210-prj85sac51

  • MD5

    ec72d5fad42825e90298005396625dd4

  • SHA1

    f484654c6f13d0d1c33b021f09b0212c64ff268d

  • SHA256

    f63086c99c27b5fd80589d07388f0a9e0707f5403bcba1158d29db6dc0610dc0

  • SHA512

    51c0b82f461b191acad34c06cdcb12e4cac6d86f8ddcc2454a18ba37bfd64eefc09f23c40053bbdd57670307167cec02c8a1350851d0b9e5e9ca1439441ac234

  • SSDEEP

    6144:F8QUOp+RSli6ojpiTwGp9zkzfMAjMpOdTaIaW7ya09m3AT2c0hckVUL9bnw2tar7:OQUg+cli6sswzfMAjMgUIaWmakm3ATF+

Score
10/10
qakbotazd1670585125bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

azd

Campaign

1670585125

C2

172.90.139.138:2222

90.116.219.167:2222

173.239.94.212:443

91.169.12.198:32100

74.66.134.24:443

66.191.69.18:995

182.75.189.42:995

78.69.251.252:2222

98.145.23.67:443

103.71.21.107:443

197.94.219.133:443

91.68.227.219:443

12.172.173.82:993

86.176.83.127:2222

64.121.161.102:443

41.98.21.114:443

92.154.17.149:2222

151.65.67.211:443

89.129.109.27:2222

76.11.14.249:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      SCANS_ED7476.lnk

    • Size

      1KB

    • MD5

      ec2ac1e8da4b9930358601c25518570a

    • SHA1

      69ae15e18ae0d277bcf740b59e138dc1c7ae6b73

    • SHA256

      ad1dbb7757e37cce274e096f0970212e858d2e338772f276d2479b18d7bc52f8

    • SHA512

      9f52e7d36d3a2e4de175fda4575758ce9da8f89e781161bae4a2e364bacb5b549744fa25f9bf0282adf6c323523ee352284a3bc7af3bea890fcdea812e086aa5

    Score
    10/10
    qakbotazd1670585125bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

    • Target

      YouContract/RecentInformation.cmd

    • Size

      9KB

    • MD5

      c415428943d6ae9df3ddf926be29f31e

    • SHA1

      c0c8057c59a80112d4e72a99c052e28bb017422a

    • SHA256

      131ef57ff1b1c67d51391ad238a9fe9507032d8e82a315a042fccbfc06b95b2e

    • SHA512

      5c1141c2c79aa93718f8555603067ce317fb64bae94e916310a062e78aae142ac549a54ef8816536687a797121d233998a0dffdf36201625107c6ea4cc3f9d8e

    • SSDEEP

      192:Crn0dKaEYw6Nndn8FkSUzUeHYNWqTJn7ami2u0mwoIWfF4J6e1:Crn0dKajNdn8ySUzUTn7ni2u0mwFIqJL

    Score
    10/10
    qakbotazd1670585125bankerstealertrojan
    behavioral3behavioral4

    • Target

      YouContract/YouNewRules.get

    • Size

      683KB

    • MD5

      3c359f052ab36b9a2dc3c295065a18a0

    • SHA1

      eaaa009b3a42ea965dd55d525e38ce40d30e4069

    • SHA256

      c2818a0dde04b70ce0f01342df88b2d01c2ab0fced4e94fdc1254bf505325bf6

    • SHA512

      c440d7a35870cb17c0a60d99ec9b9dad0fc226162bbd21c11642d4f66f4c77a44882b5b89fe46628031fdedccdc0f253fcfc0479e934664827dd0745a6152db6

    • SSDEEP

      12288:2BZFJonOQg2uym3Fkz1ee5MJ4XpJ5g7x4BdqEz6QQBGPpBi1fn:6f8OQg2uysCV3ZJ4y+Y0BEnwn

    Score
    10/10
    qakbotazd1670585125bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks