General

  • Target
    CalculationOfCosts-682392960.js
  • Size 464KB
  • Sample230615-lbbehsff6s
  • SHA256 abcf1bdff27ee3068069fe48df91980f2aecb5163f47234afe6de94fa8ff3a66
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • qakbot

Version
  • 404.1374

Botnet
  • obama268

Campaign
  • 1686733312

C2
  • 125.99.76.102:443

  • 80.12.88.148:2222

  • 109.149.147.195:2222

  • 27.99.32.26:2222

  • 70.28.50.223:3389

  • 70.28.50.223:32100

  • 86.97.96.62:2222

  • 66.241.183.99:443

  • 74.12.146.45:2222

  • 190.199.147.209:2222

  • 47.205.25.170:443

  • 12.172.173.82:993

  • 12.172.173.82:22

  • 84.35.26.14:995

  • 72.134.124.16:443

  • 85.240.173.251:2078

  • 50.68.186.195:443

  • 65.190.242.244:443

  • 45.62.75.217:443

  • 203.109.44.236:995

Targets

    • Target
      CalculationOfCosts-682392960.js
    • Size 464KB
    • SHA256 abcf1bdff27ee3068069fe48df91980f2aecb5163f47234afe6de94fa8ff3a66
    • MD5 SHA1 SHA512 SSDEEP
    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks