Overview

overview

10

Static

static

3

e10d90f8e2...c1.dll

windows7-x64

10

e10d90f8e2...c1.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e10d90f8e22f29a22f8657ca2064bdc1

  • Size

    573KB

  • Sample

    231220-tgps4aefar

  • MD5

    e10d90f8e22f29a22f8657ca2064bdc1

  • SHA1

    aa5310d1e888dc200ea7c2e5feb31f6c572480c7

  • SHA256

    90d20295ce4953c7b479857a4d369025fd415dfeb71efecbff931c85764c3fd8

  • SHA512

    38b04e19b620c7fdcd5d20f6d0583513650fe7f4e5290c04e0a8e322ff30e5aa986404b316fe99ffb5b152b34bf9dc9dcc2541d84c1c01c158f21409927e3d7e

  • SSDEEP

    12288:C87H3sH2k/eG9A9tqKsuud0/l0pT7fEztxG9HBMbVNADirS:CSs7/RYtq4E3MzO9HoH4s

Score
10/10
qakbotobama1071633078880bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

C2

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      e10d90f8e22f29a22f8657ca2064bdc1

    • Size

      573KB

    • MD5

      e10d90f8e22f29a22f8657ca2064bdc1

    • SHA1

      aa5310d1e888dc200ea7c2e5feb31f6c572480c7

    • SHA256

      90d20295ce4953c7b479857a4d369025fd415dfeb71efecbff931c85764c3fd8

    • SHA512

      38b04e19b620c7fdcd5d20f6d0583513650fe7f4e5290c04e0a8e322ff30e5aa986404b316fe99ffb5b152b34bf9dc9dcc2541d84c1c01c158f21409927e3d7e

    • SSDEEP

      12288:C87H3sH2k/eG9A9tqKsuud0/l0pT7fEztxG9HBMbVNADirS:CSs7/RYtq4E3MzO9HoH4s

    Score
    10/10
    qakbotobama1071633078880bankerevasionstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks