Overview

overview

10

Static

static

3

e35cb2b971...81.dll

windows7-x64

10

e35cb2b971...81.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e35cb2b971cc43d515eb1bf22cc6e981

  • Size

    573KB

  • Sample

    231220-tm14baagd5

  • MD5

    e35cb2b971cc43d515eb1bf22cc6e981

  • SHA1

    c5c81df36db5fac9b8866252f73791f553ae269b

  • SHA256

    cc210e4d7466f6a2b22dd37bd0a6b790e7fa307b85ab8c19b8b42ad1b2bb31c2

  • SHA512

    85af3ec67eb6d0538dfe6143555be972f7556a1d182193dd31402d395ec50205f8c3c44799189dcb27c0f5fc41385d8ef1889a493284e3669515ff734f1516dd

  • SSDEEP

    12288:c87H3sH2k/e89A9tqKsuud0jl0pT7fEztxG9HBMbVNAfirS:cSs7/HYtqsE3MzO9HoHUs

Score
10/10
qakbotobama1071633078880bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

C2

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      e35cb2b971cc43d515eb1bf22cc6e981

    • Size

      573KB

    • MD5

      e35cb2b971cc43d515eb1bf22cc6e981

    • SHA1

      c5c81df36db5fac9b8866252f73791f553ae269b

    • SHA256

      cc210e4d7466f6a2b22dd37bd0a6b790e7fa307b85ab8c19b8b42ad1b2bb31c2

    • SHA512

      85af3ec67eb6d0538dfe6143555be972f7556a1d182193dd31402d395ec50205f8c3c44799189dcb27c0f5fc41385d8ef1889a493284e3669515ff734f1516dd

    • SSDEEP

      12288:c87H3sH2k/e89A9tqKsuud0jl0pT7fEztxG9HBMbVNAfirS:cSs7/HYtqsE3MzO9HoHUs

    Score
    10/10
    qakbotobama1071633078880bankerevasionstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks