Overview

overview

10

Static

static

1

fda2abd247...92.exe

windows7-x64

10

fda2abd247...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.zip

  • Size

    678KB

  • Sample

    240402-l5j9hsee82

  • MD5

    d2ded2d3948e95fd2eeeaa6693b0b432

  • SHA1

    6ee3e79e94127da1739f993f465ba584ca8e06cf

  • SHA256

    7e0bb1837cc96c46850eb4c03c40fcb7a4338f8d655b76927a4d67f793233eb9

  • SHA512

    46d2fe298fba46827fb98a1b18b0fbc51a7209e179adc06a7c96c2f5c9ed697f0ba1d66fb90e29bab35c91e4bf31d46afde446e507ae93bab71acdc6709ee2f6

  • SSDEEP

    12288:OClZ9XM8lWZRzG1j/coaeBfabQA8Yi/SV3J8SdtzEoBcWbRMy3+5qHjmjIeS8iq0:OCZJJbraDbcY8chJRMy3+cyjIeS8iAM

Score
10/10
qakbotbmw011706268333bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882
Attributes
  • camp_date

    2024-01-26 11:25:33 +0000 UTC

Targets

    • Target

      fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

    • Size

      1.3MB

    • MD5

      f9073d4ac3089ecc2c43b73b3818582e

    • SHA1

      38813f19e54d28055b2cc4d7030cf608ca5d4c5a

    • SHA256

      fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92

    • SHA512

      bc52575d876e84c7b9b92590dc9168785021da7ce9c53e81421b307cb6de157be3e88f19aee095b0ecc6bf57f7ed02da0df1198b71ba6c292ec37d3ad50b7d35

    • SSDEEP

      24576:bH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLFg:cG8P8VcrlcwLXPpL6

    Score
    10/10
    qakbotbmw011706268333bankerstealertrojan

    • Detect Qakbot Payload

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks