General

  • Target

    CalculationOfCosts-1766400839.js

  • Size

    464KB

  • Sample

    230615-h1p3esfa72

  • MD5

    600c11d4c21d42a3f7ea3434918f6f95

  • SHA1

    c633a338e4086a7dfa9c85b104e7b9e060b4f00c

  • SHA256

    1d8104a02bbc8c8563a69cd9fc56bf4814dd840505a25c5ad05eb2025d8a1857

  • SHA512

    cc6bed606444179e9eb967d7c24ec1c509f90384447805abb06ecd44bb3a53f04489aa0171a73d33cd807d745965bd21227ede7d36030c6799ac3e9ef54fd883

  • SSDEEP

    6144:LmFamddP19SiU+g9ITla9MGNs9yec26VZU6BboaI7CRY7kkhN:oLU3+gPZUW0t

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

obama268

Campaign

1686733312

C2

125.99.76.102:443

80.12.88.148:2222

109.149.147.195:2222

27.99.32.26:2222

70.28.50.223:3389

70.28.50.223:32100

86.97.96.62:2222

66.241.183.99:443

74.12.146.45:2222

190.199.147.209:2222

47.205.25.170:443

12.172.173.82:993

12.172.173.82:22

84.35.26.14:995

72.134.124.16:443

85.240.173.251:2078

50.68.186.195:443

65.190.242.244:443

45.62.75.217:443

203.109.44.236:995

Targets

    • Target

      CalculationOfCosts-1766400839.js

    • Size

      464KB

    • MD5

      600c11d4c21d42a3f7ea3434918f6f95

    • SHA1

      c633a338e4086a7dfa9c85b104e7b9e060b4f00c

    • SHA256

      1d8104a02bbc8c8563a69cd9fc56bf4814dd840505a25c5ad05eb2025d8a1857

    • SHA512

      cc6bed606444179e9eb967d7c24ec1c509f90384447805abb06ecd44bb3a53f04489aa0171a73d33cd807d745965bd21227ede7d36030c6799ac3e9ef54fd883

    • SSDEEP

      6144:LmFamddP19SiU+g9ITla9MGNs9yec26VZU6BboaI7CRY7kkhN:oLU3+gPZUW0t

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks