Resubmissions

11-05-2023 16:12

230511-tngfaseg4t 10

11-05-2023 16:06

230511-tj2knshg64 3

General

  • Target

    23lk42joia.dll

  • Size

    418KB

  • Sample

    230511-tngfaseg4t

  • MD5

    064255eb27867f9afc3d03d540d9be7c

  • SHA1

    cc6177a86bbb1453c21a8fe4d9a2eea5f11a079f

  • SHA256

    a770f54e2275c283b919ffa78c3679e331450ca0c40d0e482ffdf2feb361cf68

  • SHA512

    9fa834e5ee58e92755116591b5f095950046f840e4c9fe49dd98ab4ab8d4337a9f0bd3055aaf24f45ce6600bd277468d793e4f29f309d4db2b711798208cdd96

  • SSDEEP

    6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8n:9/Cw6Z4nilhFX8mCXDckOPeJ

Malware Config

Extracted

Family

qakbot

Version

404.1038

Botnet

BB27

Campaign

1683816541

C2

68.68.170.218:443

142.189.121.178:2222

213.91.235.146:443

71.78.95.86:995

92.9.45.20:2222

81.229.117.95:2222

201.244.108.183:995

50.68.186.195:443

90.104.151.37:2222

92.188.241.102:443

198.2.51.242:993

12.172.173.82:20

72.222.73.150:443

31.190.225.7:443

70.54.65.197:2222

70.28.50.223:2083

172.115.17.50:443

70.112.206.5:443

122.184.143.86:443

47.32.78.150:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      23lk42joia.dll

    • Size

      418KB

    • MD5

      064255eb27867f9afc3d03d540d9be7c

    • SHA1

      cc6177a86bbb1453c21a8fe4d9a2eea5f11a079f

    • SHA256

      a770f54e2275c283b919ffa78c3679e331450ca0c40d0e482ffdf2feb361cf68

    • SHA512

      9fa834e5ee58e92755116591b5f095950046f840e4c9fe49dd98ab4ab8d4337a9f0bd3055aaf24f45ce6600bd277468d793e4f29f309d4db2b711798208cdd96

    • SSDEEP

      6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8n:9/Cw6Z4nilhFX8mCXDckOPeJ

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks