Overview

overview

10

Static

static

3

5aa6982194...18.dll

windows7-x64

10

5aa6982194...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5aa6982194b786a9fffc753b71634e5c_JaffaCakes118

  • Size

    574KB

  • Sample

    240331-w1lxnagf3v

  • MD5

    5aa6982194b786a9fffc753b71634e5c

  • SHA1

    62eba371ab9174dfee99283afdcc3542870edd2b

  • SHA256

    06108c841a33fa691b3b249ca8af7d933de467ee22323c8b008a6ec151824be9

  • SHA512

    ac1962df06ab74628ada9fa555a45321f6cb9a716b46d7806ca57aacf20307e0aa09f40be8a2e12b161a9d1d0d8d8a1a6908d0e68cfba3de13e91545b4cb28da

  • SSDEEP

    3072:uqeP24iABEabz1fz+Bnp1WC3poldfzaSXO3etYkf35qSyYNYuFwXBBWYn0WW6xEe:FUJicLfz+hqs4BtYm35qjY7wXr8nkRv

Score
10/10
qakbottr1634541613bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      5aa6982194b786a9fffc753b71634e5c_JaffaCakes118

    • Size

      574KB

    • MD5

      5aa6982194b786a9fffc753b71634e5c

    • SHA1

      62eba371ab9174dfee99283afdcc3542870edd2b

    • SHA256

      06108c841a33fa691b3b249ca8af7d933de467ee22323c8b008a6ec151824be9

    • SHA512

      ac1962df06ab74628ada9fa555a45321f6cb9a716b46d7806ca57aacf20307e0aa09f40be8a2e12b161a9d1d0d8d8a1a6908d0e68cfba3de13e91545b4cb28da

    • SSDEEP

      3072:uqeP24iABEabz1fz+Bnp1WC3poldfzaSXO3etYkf35qSyYNYuFwXBBWYn0WW6xEe:FUJicLfz+hqs4BtYm35qjY7wXr8nkRv

    Score
    10/10
    qakbottr1634541613bankerevasionstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks