General

  • Target

    CrazyDogCat.dll

  • Size

    418KB

  • Sample

    230512-p36aradb54

  • MD5

    1e6dfbca6efb328ba8cfeba5d7f20c09

  • SHA1

    9b950f959d4393f593a61c771ef5067c84a16d96

  • SHA256

    9fe514a1fb8c475a090aea786d195e64be3697a54b191db73011d14b8c382b75

  • SHA512

    ecd40954703b7d7db52c204517ea34ed2f6e2dc4afacd77a1c4d7256820373dc961bc0ca5190151410efa7d865d535d49d9681adbf51d612956f6741fdb43376

  • SSDEEP

    6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8E:9/Cw6Z4nilhFX8mCXDckOPeJ

Malware Config

Extracted

Family

qakbot

Version

404.1038

Botnet

BB27

Campaign

1683816541

C2

68.68.170.218:443

142.189.121.178:2222

213.91.235.146:443

71.78.95.86:995

92.9.45.20:2222

81.229.117.95:2222

201.244.108.183:995

50.68.186.195:443

90.104.151.37:2222

92.188.241.102:443

198.2.51.242:993

12.172.173.82:20

72.222.73.150:443

31.190.225.7:443

70.54.65.197:2222

70.28.50.223:2083

172.115.17.50:443

70.112.206.5:443

122.184.143.86:443

47.32.78.150:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      CrazyDogCat.dll

    • Size

      418KB

    • MD5

      1e6dfbca6efb328ba8cfeba5d7f20c09

    • SHA1

      9b950f959d4393f593a61c771ef5067c84a16d96

    • SHA256

      9fe514a1fb8c475a090aea786d195e64be3697a54b191db73011d14b8c382b75

    • SHA512

      ecd40954703b7d7db52c204517ea34ed2f6e2dc4afacd77a1c4d7256820373dc961bc0ca5190151410efa7d865d535d49d9681adbf51d612956f6741fdb43376

    • SSDEEP

      6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8E:9/Cw6Z4nilhFX8mCXDckOPeJ

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks