Overview

overview

10

Static

static

1

fda2abd247...92.exe

windows7-x64

10

fda2abd247...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.zip

  • Size

    678KB

  • Sample

    240402-mnq66sfg48

  • MD5

    1e352ba666136dad506efba594b9f751

  • SHA1

    980feb0dff2420de7e87d91495b344de61efc977

  • SHA256

    bcabc3f244e2bd0754c776aa430de16340149102f9d929cff643465976145ce4

  • SHA512

    8a78bc04806345bee5850b34096eb2a9843baf8c373556641f8664a17d6cc6d30e115f965f5855380cf342182bb8ff7b104d830db186d3026eced7c991081542

  • SSDEEP

    12288:xHMT7Ktg916Jme5VUUXit/Em7/lKpYHyqWw9/BsK1Uz9TtZRa1CKpGQp:ivKtg916Jt5Xyt/hRKpYHyqWw9/BIz9Y

Score
10/10
qakbotbmw011706268333bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882
Attributes
  • camp_date

    2024-01-26 11:25:33 +0000 UTC

Targets

    • Target

      fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

    • Size

      1.3MB

    • MD5

      f9073d4ac3089ecc2c43b73b3818582e

    • SHA1

      38813f19e54d28055b2cc4d7030cf608ca5d4c5a

    • SHA256

      fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92

    • SHA512

      bc52575d876e84c7b9b92590dc9168785021da7ce9c53e81421b307cb6de157be3e88f19aee095b0ecc6bf57f7ed02da0df1198b71ba6c292ec37d3ad50b7d35

    • SSDEEP

      24576:bH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLFg:cG8P8VcrlcwLXPpL6

    Score
    10/10
    qakbotbmw011706268333bankerstealertrojan

    • Detect Qakbot Payload

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks