Overview

overview

10

Static

static

1

2d9a718e60...ll.xll

windows7-x64

7

2d9a718e60...ll.xll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d9a718e60238a696d4616ef279c0a99a05d1fbb2efaded26db1f0c3ba5acde6.dll.exe

  • Size

    13.5MB

  • Sample

    230407-bf3z8afh42

  • MD5

    a46c696d1afb964a9dc8b838e8978bd2

  • SHA1

    edc5ee2ebb8a7f7563a102ce5ee35c5c50276cc6

  • SHA256

    2d9a718e60238a696d4616ef279c0a99a05d1fbb2efaded26db1f0c3ba5acde6

  • SHA512

    1f2247b49c8e3142bd6d92e5faefd14467de584ccff6d6424d57b1c7974151b7cdc0fb47617077fc2e7cf99d7405785e2d321cbd5a316f2a2f11b3a64328f895

  • SSDEEP

    49152:LfNqvX0brf57E7CMelJadKe3fUZ5TwEktnXhCLfmP+JhkCXfHz:sv03xQCM/82fUZWXRhqfmP+Jhkkz

Score
10/10
qakbottzr011649312144bankerstealertrojan

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

qakbot

Version

403.573

Botnet

tzr01

Campaign

1649312144

C2

140.82.49.12:443

182.191.92.203:995

176.67.56.94:443

148.64.96.100:443

47.180.172.159:443

47.23.89.62:995

181.118.183.98:443

1.161.121.58:995

96.21.251.127:2222

119.158.126.69:995

41.228.22.180:443

176.88.238.122:995

66.98.42.102:443

83.110.85.209:443

208.107.221.224:443

172.115.177.204:2222

73.67.152.98:2222

176.205.119.81:2078

46.107.48.202:443

81.215.196.174:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      2d9a718e60238a696d4616ef279c0a99a05d1fbb2efaded26db1f0c3ba5acde6.dll.exe

    • Size

      13.5MB

    • MD5

      a46c696d1afb964a9dc8b838e8978bd2

    • SHA1

      edc5ee2ebb8a7f7563a102ce5ee35c5c50276cc6

    • SHA256

      2d9a718e60238a696d4616ef279c0a99a05d1fbb2efaded26db1f0c3ba5acde6

    • SHA512

      1f2247b49c8e3142bd6d92e5faefd14467de584ccff6d6424d57b1c7974151b7cdc0fb47617077fc2e7cf99d7405785e2d321cbd5a316f2a2f11b3a64328f895

    • SSDEEP

      49152:LfNqvX0brf57E7CMelJadKe3fUZ5TwEktnXhCLfmP+JhkCXfHz:sv03xQCM/82fUZWXRhqfmP+Jhkkz

    Score
    10/10
    qakbottzr011649312144bankerstealertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks