Overview

overview

10

Static

static

1

9560988063.zip

windows7-x64

1

9560988063.zip

windows10-2004-x64

1

8e6a578599...77.xll

windows7-x64

10

8e6a578599...77.xll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9560988063.zip

  • Size

    344KB

  • Sample

    230315-s9g4aaea87

  • MD5

    76baa65efd74386efc94b2639da37849

  • SHA1

    b18e84c959f93c8f1d93ddedab5cc2a9e5f72067

  • SHA256

    cdeec4a42f876388010cb9cc27a4376b933149000e3bdaf0793e5ceaa35944b9

  • SHA512

    5e4303f065e7014fcdb64e77e7f040ee653d3b64a00a0073b67847ba50a84bd7537a1f9be0eedefcbafca65099122b1d9b03142bf3116c35bc52f315415b7651

  • SSDEEP

    6144:amtr230km7jHD3tY5JkLPunVA8dIJ3cHfH1uJEO/K87Dxfw9sHeS59QOjubfHc+6:aYlT7HUkLw68dIWHfH1uJE+Ou+SDjubC

Score
10/10
qakbotobama2421678805546bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.266

Botnet

obama242

Campaign

1678805546

C2

92.239.81.124:443

176.202.46.81:443

2.49.58.47:2222

86.225.214.138:2222

74.66.134.24:443

213.31.90.183:2222

12.172.173.82:50001

202.187.87.178:995

70.53.96.223:995

92.154.45.81:2222

186.64.67.54:443

81.158.112.20:2222

190.191.35.122:443

68.173.170.110:8443

12.172.173.82:993

98.145.23.67:443

12.172.173.82:22

37.186.55.60:2222

84.216.198.124:6881

73.161.176.218:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      9560988063.zip

    • Size

      344KB

    • MD5

      76baa65efd74386efc94b2639da37849

    • SHA1

      b18e84c959f93c8f1d93ddedab5cc2a9e5f72067

    • SHA256

      cdeec4a42f876388010cb9cc27a4376b933149000e3bdaf0793e5ceaa35944b9

    • SHA512

      5e4303f065e7014fcdb64e77e7f040ee653d3b64a00a0073b67847ba50a84bd7537a1f9be0eedefcbafca65099122b1d9b03142bf3116c35bc52f315415b7651

    • SSDEEP

      6144:amtr230km7jHD3tY5JkLPunVA8dIJ3cHfH1uJEO/K87Dxfw9sHeS59QOjubfHc+6:aYlT7HUkLw68dIWHfH1uJE+Ou+SDjubC

    Score
    1/10
    behavioral1behavioral2

    • Target

      8e6a578599da66e8acf7dd4202fc3ef83b64e2c48391db1c580b2529251d3277

    • Size

      589KB

    • MD5

      7555576d5752d18e33dba37be01669cd

    • SHA1

      745bf4d11e8e632f584b8a011b271fb322167cbb

    • SHA256

      8e6a578599da66e8acf7dd4202fc3ef83b64e2c48391db1c580b2529251d3277

    • SHA512

      cd13aad149e0562871481d0a91d9b21cffb432673fd1e8fbd9c29c8829e97bd673d16907ccd76c0dd8236c8ea7febae4c81f97cb7f24ab8681904d8d0a432888

    • SSDEEP

      6144:8cTaT6oGCNIamrNSYVntVpONtX7EmG2dOdQRG8l/dmMF7VndLmmmmmmm644tkw95:fNpSIm3OdQwgvpVndf42HXDiuJTMw4

    Score
    10/10
    qakbotobama2421678805546bankerstealertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks