General
-
Target
310e65a59d3c670bc2bededf7ddef03e_JaffaCakes118
-
Size
596KB
-
Sample
240510-zz7phsch55
-
MD5
310e65a59d3c670bc2bededf7ddef03e
-
SHA1
77153c24512610f9ff8e00bf944a9fee8c8f2974
-
SHA256
5cfbe018afa45304fb2d7775f635101ee4226ba594bb30cc0e5c017fd1d30da1
-
SHA512
b2d7f3c16fa3f080a72b02b70319b1ab821a8910851e33e4655784f5371931782d58c92a2ddf37d0f5e429133b84481743f9b80a357e6a2615206c5e323d61a8
-
SSDEEP
6144:BwzoiTihMxUxXH/64Hlh64tEfqpoSliPic7p0mO2WDJNkHtcvvwzRfI5aCieTVU:GzhTicUxlGUxoVPi79qHteyfIEeT
Malware Config
Extracted
https://www.dropbox.com/s/41zf98knyy5atko/001_01.ps1?dl=1
https://www.dropbox.com/s/dh8flnrogfq1h1w/001.ps1?dl=1
Extracted
qakbot
322.358
mc06
1527585056
Protocol: ftp- Host:
37.60.244.211 - Port:
21 - Username:
backup_manager@garciasdrywall.com - Password:
4AsEzIaMwi2d
Protocol: ftp- Host:
198.38.77.162 - Port:
21 - Username:
backup_manager@worldexpresscargo.com - Password:
kJm6DKVPfyiv
Protocol: ftp- Host:
61.221.12.26 - Port:
21 - Username:
logger@ostergift.com - Password:
346HZGCMlwecz9S
Protocol: ftp- Host:
67.222.137.18 - Port:
21 - Username:
logger@grupocrepusculo.net - Password:
p4a8k6fE1FtA3pR
Protocol: ftp- Host:
107.6.152.61 - Port:
21 - Username:
logger@trussedup.com - Password:
RoP4Af0RKAAQ74V
71.168.229.249:995
216.21.168.27:32101
216.218.74.196:443
46.177.55.119:443
66.222.48.40:443
93.108.180.227:443
47.40.29.239:443
184.180.157.203:2222
47.40.208.189:443
71.168.229.249:443
216.93.143.182:995
98.16.70.197:2222
75.127.141.50:995
96.248.15.254:995
74.87.248.174:2222
75.189.235.216:443
66.42.182.18:995
50.252.93.122:995
105.187.37.52:443
190.137.254.188:443
Extracted
https://www.dropbox.com/s/41zf98knyy5atko/001_01.ps1?dl=1
https://www.dropbox.com/s/dh8flnrogfq1h1w/001.ps1?dl=1
Targets
-
-
Target
310e65a59d3c670bc2bededf7ddef03e_JaffaCakes118
-
Size
596KB
-
MD5
310e65a59d3c670bc2bededf7ddef03e
-
SHA1
77153c24512610f9ff8e00bf944a9fee8c8f2974
-
SHA256
5cfbe018afa45304fb2d7775f635101ee4226ba594bb30cc0e5c017fd1d30da1
-
SHA512
b2d7f3c16fa3f080a72b02b70319b1ab821a8910851e33e4655784f5371931782d58c92a2ddf37d0f5e429133b84481743f9b80a357e6a2615206c5e323d61a8
-
SSDEEP
6144:BwzoiTihMxUxXH/64Hlh64tEfqpoSliPic7p0mO2WDJNkHtcvvwzRfI5aCieTVU:GzhTicUxlGUxoVPi79qHteyfIEeT
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-