Overview

overview

10

Static

static

3

dfe1abe2c5...99.exe

windows7-x64

10

dfe1abe2c5...99.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.zip

  • Size

    671KB

  • Sample

    240402-mnqweafc3y

  • MD5

    a217fce1c48fce625a37eedc2e7f5777

  • SHA1

    900e80e920585225b4b31c6df8b2dedf7faa6a54

  • SHA256

    78d7715bfea3e635666e19e58a6f6015e8399a9c706e3c3b5f25161fef41ce38

  • SHA512

    d83f82400d4a6d0c95945d7597ffcb6fd7d9c22c500a9814a86efd850ca3d47bbc1ee1c830cfccbb040b49c25cc1b1ae68405a51db279dce652b2b1dae122544

  • SSDEEP

    12288:0qtbTVG2nMcmLLwDUdckVZof1zs43Yp7rbycJnCu3bz4u8vEF/gVul:0wbVnfxDUdvoKF7q6nRMxvugAl

Score
10/10
qakbotbmw011706268333bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882
Attributes
  • camp_date

    2024-01-26 11:25:33 +0000 UTC

Targets

    • Target

      dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

    • Size

      1.3MB

    • MD5

      5fec958eac0d6cd761e99616b86f9cf2

    • SHA1

      fe0515cb74a579b293b3ea2d2cd88b0192326455

    • SHA256

      dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699

    • SHA512

      7cf78df279f4cf31fa763a7ddbaa70879c5e697adf9fac8cd4650b1e6454ad874a0e058da99a886620740bdd526eb4a8eabb1c9693e991b492a3d627bdcdbe6c

    • SSDEEP

      24576:pH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLF2:GG8P8VcrlcwLXPpL8

    Score
    10/10
    qakbotbmw011706268333bankerstealertrojan

    • Detect Qakbot Payload

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks