Overview

overview

10

Static

static

3

ec5702b803...fc.dll

windows7-x64

10

ec5702b803...fc.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec5702b803de813dbbcae69a2427d1fc

  • Size

    573KB

  • Sample

    231220-t9mjfahef2

  • MD5

    ec5702b803de813dbbcae69a2427d1fc

  • SHA1

    e8a74a8db218b06dc1ecfce0147ef46deebd558f

  • SHA256

    ba7e19741fdd2bc1562f7be45830906c2dc2310720afb17b7c435b0197bffa5d

  • SHA512

    b7e987afcfebaed5c22915b4c3c454190d55515ba6ca613dd5e1c4bfd7d8c3cabc84aff26da5f7de98127b4514fcb2b4ac7e17f1d7d028e2f09e518d124944b9

  • SSDEEP

    12288:e87H3sH2k/e09A9tqKsuud0fl0pT7fEztxG9HBMbVNAfirS:eSs7/nYtqoE3MzO9HoHks

Score
10/10
qakbotobama1071633078880bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

C2

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      ec5702b803de813dbbcae69a2427d1fc

    • Size

      573KB

    • MD5

      ec5702b803de813dbbcae69a2427d1fc

    • SHA1

      e8a74a8db218b06dc1ecfce0147ef46deebd558f

    • SHA256

      ba7e19741fdd2bc1562f7be45830906c2dc2310720afb17b7c435b0197bffa5d

    • SHA512

      b7e987afcfebaed5c22915b4c3c454190d55515ba6ca613dd5e1c4bfd7d8c3cabc84aff26da5f7de98127b4514fcb2b4ac7e17f1d7d028e2f09e518d124944b9

    • SSDEEP

      12288:e87H3sH2k/e09A9tqKsuud0fl0pT7fEztxG9HBMbVNAfirS:eSs7/nYtqoE3MzO9HoHks

    Score
    10/10
    qakbotobama1071633078880bankerevasionstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks