General

  • Target

    CalculationOfCosts-682392960.js

  • Size

    464KB

  • Sample

    230615-lbbehsff6s

  • MD5

    86d04c23e01dee18584a919472874806

  • SHA1

    530df1f12eb542deb1b9c6c87774d99b5b484e8f

  • SHA256

    abcf1bdff27ee3068069fe48df91980f2aecb5163f47234afe6de94fa8ff3a66

  • SHA512

    ac40379d39f62a7e4396e1f3c8b5e20ada14bcd1c00f39d8485b908c70d2e439d2105c2bc182e09012d07be8bdfe491adb8b3c2ca0604d0aabca70c66babc047

  • SSDEEP

    6144:LmFamddP19SiU+g9ITla9MGNs9yec26VZU6BboaI7CRY7kkht:oLU3+gPZUW0N

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

obama268

Campaign

1686733312

C2

125.99.76.102:443

80.12.88.148:2222

109.149.147.195:2222

27.99.32.26:2222

70.28.50.223:3389

70.28.50.223:32100

86.97.96.62:2222

66.241.183.99:443

74.12.146.45:2222

190.199.147.209:2222

47.205.25.170:443

12.172.173.82:993

12.172.173.82:22

84.35.26.14:995

72.134.124.16:443

85.240.173.251:2078

50.68.186.195:443

65.190.242.244:443

45.62.75.217:443

203.109.44.236:995

Targets

    • Target

      CalculationOfCosts-682392960.js

    • Size

      464KB

    • MD5

      86d04c23e01dee18584a919472874806

    • SHA1

      530df1f12eb542deb1b9c6c87774d99b5b484e8f

    • SHA256

      abcf1bdff27ee3068069fe48df91980f2aecb5163f47234afe6de94fa8ff3a66

    • SHA512

      ac40379d39f62a7e4396e1f3c8b5e20ada14bcd1c00f39d8485b908c70d2e439d2105c2bc182e09012d07be8bdfe491adb8b3c2ca0604d0aabca70c66babc047

    • SSDEEP

      6144:LmFamddP19SiU+g9ITla9MGNs9yec26VZU6BboaI7CRY7kkht:oLU3+gPZUW0N

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks