Overview

overview

10

Static

static

1

fda2abd247...92.exe

windows7-x64

10

fda2abd247...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.zip

  • Size

    678KB

  • Sample

    240402-qebxnsag61

  • MD5

    5527aa9aecf042d86a1b2d052c399991

  • SHA1

    e8d870547a058e662f1e7cd59a0f009c56e2c171

  • SHA256

    fb4ad69654963ad278a6f97a021ee764292a9e86ca1bb85d54fba44534261616

  • SHA512

    63eeab2c26f29e4be26fc9ee143e9e3dbb330d29f4e05a17bee79c28f2b264339839b3968c087221cf424c3aca494bd14813987ebe3d9331174ed8d9a67d0f75

  • SSDEEP

    12288:qYS9dOjynSgbHy/p3wW1SINJi2NP4v519pqCixzBfTFFXaXuM3KY+st1NUk41:Gojy1bS/dwUSsJb4j9pqCoBfTFZa1KY6

Score
10/10
qakbotbmw011706268333bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882
Attributes
  • camp_date

    2024-01-26 11:25:33 +0000 UTC

Targets

    • Target

      fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

    • Size

      1.3MB

    • MD5

      f9073d4ac3089ecc2c43b73b3818582e

    • SHA1

      38813f19e54d28055b2cc4d7030cf608ca5d4c5a

    • SHA256

      fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92

    • SHA512

      bc52575d876e84c7b9b92590dc9168785021da7ce9c53e81421b307cb6de157be3e88f19aee095b0ecc6bf57f7ed02da0df1198b71ba6c292ec37d3ad50b7d35

    • SSDEEP

      24576:bH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLFg:cG8P8VcrlcwLXPpL6

    Score
    10/10
    qakbotbmw011706268333bankerstealertrojan

    • Detect Qakbot Payload

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks