Overview

overview

10

Static

static

3

88a64b448f...54.dll

windows7-x64

10

88a64b448f...54.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88a64b448fee1f6067e4c22be41f2554

  • Size

    750KB

  • Sample

    231219-yhjqpahfb3

  • MD5

    88a64b448fee1f6067e4c22be41f2554

  • SHA1

    c83e65bf388ff98557d36d41cc8187d1f4291de0

  • SHA256

    d9294f586f52e107f25cfe1061cc6272a82128a83f5c4a3cc95e925b5b6f1463

  • SHA512

    352a7aeb9873edc63b193b44bcd07f9600c440ad701e73f135eda925b696f72b51796fbd2f0d81d496289788fde00f4aa6bbeec0c0ad7ec8e4bf8c43d24e026b

  • SSDEEP

    12288:ZV75XRqXnVyGXpI7gFHpsqJtjA42je3kyS6wEB35cmCy:SXnVyy9WIkBy3kySqBpZV

Score
10/10
qakbotobama1051632821932bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama105

Campaign

1632821932

C2

120.151.47.189:443

41.228.22.180:443

39.52.241.3:995

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      88a64b448fee1f6067e4c22be41f2554

    • Size

      750KB

    • MD5

      88a64b448fee1f6067e4c22be41f2554

    • SHA1

      c83e65bf388ff98557d36d41cc8187d1f4291de0

    • SHA256

      d9294f586f52e107f25cfe1061cc6272a82128a83f5c4a3cc95e925b5b6f1463

    • SHA512

      352a7aeb9873edc63b193b44bcd07f9600c440ad701e73f135eda925b696f72b51796fbd2f0d81d496289788fde00f4aa6bbeec0c0ad7ec8e4bf8c43d24e026b

    • SSDEEP

      12288:ZV75XRqXnVyGXpI7gFHpsqJtjA42je3kyS6wEB35cmCy:SXnVyy9WIkBy3kySqBpZV

    Score
    10/10
    qakbotobama1051632821932bankerevasionstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks