Overview

overview

10

Static

static

1

93f7cc7cbe...6c.xll

windows7-x64

10

93f7cc7cbe...6c.xll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9564270356.zip

  • Size

    344KB

  • Sample

    230314-yk1f8abd8y

  • MD5

    89ecc7644237e733404618e96f51a999

  • SHA1

    3f9dfc2741dc81325e37fa8deb4acc6ecf1bee3c

  • SHA256

    bf6fc61de7948c32dfca8c5c6c78e8b2c4cd7d9a30428cca9fd43445d0a92520

  • SHA512

    d6c375fe2081710f6aa57945d22356189e9916ca517220a8ed8030e3b09420275dcfbdc31cc2cb52fb4f36a824af1a4eef08d2c19ef4af8aa3aeca9c524e9442

  • SSDEEP

    6144:Hmtr230km7jHrVQtuuv55U5SMF5O0fljwn6uV1nKV8WnLGu1rI3Uw6:HYlT7+uuDUYoHlM6nLnLT1rEUf

Score
10/10
qakbotobama2421678805546bankerstealertrojan

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

qakbot

Version

404.266

Botnet

obama242

Campaign

1678805546

C2

92.239.81.124:443

176.202.46.81:443

2.49.58.47:2222

86.225.214.138:2222

74.66.134.24:443

213.31.90.183:2222

12.172.173.82:50001

202.187.87.178:995

70.53.96.223:995

92.154.45.81:2222

186.64.67.54:443

81.158.112.20:2222

190.191.35.122:443

68.173.170.110:8443

12.172.173.82:993

98.145.23.67:443

12.172.173.82:22

37.186.55.60:2222

84.216.198.124:6881

73.161.176.218:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      93f7cc7cbe37bd20991ebf0f5bab5f4a8bf44d59574a8fcce808f952e0db1c6c

    • Size

      589KB

    • MD5

      ac44e14da94807ebfba7f66890228ab9

    • SHA1

      bd2e9ce40ce5579bfb5fcf9261bb6723f392fc7a

    • SHA256

      93f7cc7cbe37bd20991ebf0f5bab5f4a8bf44d59574a8fcce808f952e0db1c6c

    • SHA512

      9a6bdbe96f4ab2421755ef9595faf588734a06637e337b75494b1b7fad05714f636c00a72e7f1dfd591c7f2fd386b5540bdcce8adb22308c798088fbaa0a61ca

    • SSDEEP

      6144:8cTaT6oGCNIamrNSYVntMpONtX7EmG2dOdQRG8l/dmMF7VndLmmmmmmm644tkw95:fEpSIm3OdQwgvpVndf42HXDiuJTMw4

    Score
    10/10
    qakbotobama2421678805546bankerstealertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks