Overview

overview

10

Static

static

3

711f5f3963...18.dll

windows7-x64

10

711f5f3963...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    711f5f3963d842fece4327bd15364182_JaffaCakes118

  • Size

    572KB

  • Sample

    240401-nxn9lsea89

  • MD5

    711f5f3963d842fece4327bd15364182

  • SHA1

    08e210d7d393bc8f20d36e20a4586b9e721bd0c9

  • SHA256

    dadaccf2c61cf016af68f9337498b27f1f0a827c1d9a62183d5defb4d88714b3

  • SHA512

    db0eb12f4dd0db65a06055cde2fa2bfae55118505814b9fa4947d4cb19d8327b51ee24bf0e6279e07e0d57bbc03b95e0e89ad9b793c29e862b17fb2254f9aa48

  • SSDEEP

    6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHx:VvAfLfaEkAz5i

Score
10/10
qakbotobama1141634112211bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      711f5f3963d842fece4327bd15364182_JaffaCakes118

    • Size

      572KB

    • MD5

      711f5f3963d842fece4327bd15364182

    • SHA1

      08e210d7d393bc8f20d36e20a4586b9e721bd0c9

    • SHA256

      dadaccf2c61cf016af68f9337498b27f1f0a827c1d9a62183d5defb4d88714b3

    • SHA512

      db0eb12f4dd0db65a06055cde2fa2bfae55118505814b9fa4947d4cb19d8327b51ee24bf0e6279e07e0d57bbc03b95e0e89ad9b793c29e862b17fb2254f9aa48

    • SSDEEP

      6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHx:VvAfLfaEkAz5i

    Score
    10/10
    qakbotobama1141634112211bankerevasionstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks