Overview

overview

10

Static

static

SCANS_ED7476.lnk

windows7-x64

10

SCANS_ED7476.lnk

windows10-2004-x64

10

YouContrac...on.cmd

windows7-x64

10

YouContrac...on.cmd

windows10-2004-x64

10

YouContrac...es.dll

windows7-x64

10

YouContrac...es.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    45107e7c-d71f-4d2c-85a3-c8f39ef5f02a.zip

  • Size

    411KB

  • Sample

    221210-qxyt6aff23

  • MD5

    077f68ac69181ee01e55594ecc5fba91

  • SHA1

    0536edf26089adebb60fa5fbdabf8f94f176c4d1

  • SHA256

    fbd69365f87ffdc8a5402d7aee0995c321c2dcc8b37861ddafea9db18f0a6a4c

  • SHA512

    07331d5046e1690bbaa65ff71b66ef5fa0bc8a4182f669b72778944da85044e5877abbec4978c54e5ffec350ec0df91a960e2d67fc44d0d1d5236c42692c3be0

  • SSDEEP

    12288:ejBmIItQRkfa2CL1DDBTFTZAcyZEwpM1z4hTS:e0tQRpDD1AzEwozy+

Score
10/10
qakbotazd1670585125bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

azd

Campaign

1670585125

C2

172.90.139.138:2222

90.116.219.167:2222

173.239.94.212:443

91.169.12.198:32100

74.66.134.24:443

66.191.69.18:995

182.75.189.42:995

78.69.251.252:2222

98.145.23.67:443

103.71.21.107:443

197.94.219.133:443

91.68.227.219:443

12.172.173.82:993

86.176.83.127:2222

64.121.161.102:443

41.98.21.114:443

92.154.17.149:2222

151.65.67.211:443

89.129.109.27:2222

76.11.14.249:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      SCANS_ED7476.lnk

    • Size

      1KB

    • MD5

      ec2ac1e8da4b9930358601c25518570a

    • SHA1

      69ae15e18ae0d277bcf740b59e138dc1c7ae6b73

    • SHA256

      ad1dbb7757e37cce274e096f0970212e858d2e338772f276d2479b18d7bc52f8

    • SHA512

      9f52e7d36d3a2e4de175fda4575758ce9da8f89e781161bae4a2e364bacb5b549744fa25f9bf0282adf6c323523ee352284a3bc7af3bea890fcdea812e086aa5

    Score
    10/10
    qakbotazd1670585125bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

    • Target

      YouContract/RecentInformation.cmd

    • Size

      9KB

    • MD5

      c415428943d6ae9df3ddf926be29f31e

    • SHA1

      c0c8057c59a80112d4e72a99c052e28bb017422a

    • SHA256

      131ef57ff1b1c67d51391ad238a9fe9507032d8e82a315a042fccbfc06b95b2e

    • SHA512

      5c1141c2c79aa93718f8555603067ce317fb64bae94e916310a062e78aae142ac549a54ef8816536687a797121d233998a0dffdf36201625107c6ea4cc3f9d8e

    • SSDEEP

      192:Crn0dKaEYw6Nndn8FkSUzUeHYNWqTJn7ami2u0mwoIWfF4J6e1:Crn0dKajNdn8ySUzUTn7ni2u0mwFIqJL

    Score
    10/10
    qakbotazd1670585125bankerstealertrojan
    behavioral3behavioral4

    • Target

      YouContract/YouNewRules.get

    • Size

      683KB

    • MD5

      3c359f052ab36b9a2dc3c295065a18a0

    • SHA1

      eaaa009b3a42ea965dd55d525e38ce40d30e4069

    • SHA256

      c2818a0dde04b70ce0f01342df88b2d01c2ab0fced4e94fdc1254bf505325bf6

    • SHA512

      c440d7a35870cb17c0a60d99ec9b9dad0fc226162bbd21c11642d4f66f4c77a44882b5b89fe46628031fdedccdc0f253fcfc0479e934664827dd0745a6152db6

    • SSDEEP

      12288:2BZFJonOQg2uym3Fkz1ee5MJ4XpJ5g7x4BdqEz6QQBGPpBi1fn:6f8OQg2uysCV3ZJ4y+Y0BEnwn

    Score
    10/10
    qakbotazd1670585125bankerstealertrojan
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks