Overview

overview

10

Static

static

3

2fb3da9591...6d.exe

windows7-x64

10

2fb3da9591...6d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.zip

  • Size

    671KB

  • Sample

    240402-qvv1gsbf5w

  • MD5

    911787eb6421c205c67b66fe5f938712

  • SHA1

    ecf47ddd15837e8e5f25a466e964ef689ee38a1b

  • SHA256

    b4113c2cf66bd9a06b6ad9ddf322a6297197e37e36261375bc06c45e25474b72

  • SHA512

    e1f0e6eae5aa2feb11c190ff740c337c4451553a644206e7b46179fb179624ee320a8ba16680a41881be3b323379a6e1890fa31a011abb1e4f4cd2ca3d5ed666

  • SSDEEP

    12288:tmEweWBtwPrJsew0Nbw2Oyn8FypZjrwwtcIWRxZz29Y0+Tukc1u36owuUe2Fklun:t/w/BiPrK90NrbnM61wwPWRxZz260sun

Score
10/10
qakbotbmw011706268333bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882
Attributes
  • camp_date

    2024-01-26 11:25:33 +0000 UTC

Targets

    • Target

      2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe

    • Size

      1.3MB

    • MD5

      041f11543edf5591a8fb7b0037e3d115

    • SHA1

      ee5fb2448d4437c2eaefdfb7cac13a0a2162a775

    • SHA256

      2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d

    • SHA512

      3e3e5634cb560178ec75b2a74a92a9bbacedf53f046491ebf9e2d7849b1b1ea5327cf9e8e3cc2ffc3938ca12d6ab281ae466b4446c2b338fa35976ef6f5b83c4

    • SSDEEP

      24576:6H4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLF2:1G8P8VcrlcwLXPpL8

    Score
    10/10
    qakbotbmw011706268333bankerstealertrojan

    • Detect Qakbot Payload

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks