Overview

overview

10

Static

static

3

6438/8157.cmd

windows7-x64

7

6438/8157.cmd

windows10-2004-x64

7

6438/plugged.dll

windows7-x64

10

6438/plugged.dll

windows10-2004-x64

10

Overdue.lnk

windows7-x64

1

Overdue.lnk

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    951cc98b54bc4d78ce4f11a3bdbfdaee7777591ffef88bb2557ebecbb1909013.iso

  • Size

    446KB

  • Sample

    240614-b2frtatgkn

  • MD5

    1a5d350d71f6821006691ac076e026e0

  • SHA1

    1dfb04e5d3f71b03085b3787e4970281f08bff74

  • SHA256

    951cc98b54bc4d78ce4f11a3bdbfdaee7777591ffef88bb2557ebecbb1909013

  • SHA512

    191ffda025f43e4133cd9bd941304adb2057c557cecab95207a02a117c57533c0713233f8701965f9699da2c891a97c6f26f55e9b9c11accfc0eaa11f3dc753c

  • SSDEEP

    6144:etgTFlqteWTBa5WsoUReNsyLK9d8WqniKS9jyA9yjHHXsBcfmL/p+LIORL6qYFYM:U8z4TU5WsoURzN9WtniPHlQEFYM

Score
10/10
qakbotobama2101665041236bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.914

Botnet

obama210

Campaign

1665041236

C2

41.104.205.128:443

134.35.6.76:443

197.202.163.4:443

181.164.194.228:443

105.159.124.224:443

197.158.89.85:443

41.96.33.236:443

181.141.3.126:443

123.22.7.132:443

163.182.177.80:443

41.248.72.229:8443

41.100.62.129:443

68.83.169.91:443

190.29.228.61:443

160.176.249.11:995

41.107.54.99:443

94.52.127.44:443

105.69.155.85:995

45.227.251.167:2222

197.206.141.97:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      6438/8157.cmd

    • Size

      275B

    • MD5

      533d29a067a011b9115e4fcbc94305d7

    • SHA1

      1ff3aa4f90e4933ebfe20e1398dc22ecf8a2e771

    • SHA256

      7bad03aef5b3d3c66dd5a4ed8a82d18643e90536b963e0711611e3266f24d054

    • SHA512

      01d8fc83062dd83e15d3345e2463c6161c052e50a9cfe416de0f7ed569cc02cd63c091f5537ad0ceedf7414cad74ccbd96ab732587b873dd7152c6faadaf5d00

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      6438/plugged.dat

    • Size

      386KB

    • MD5

      88f2abefd23b14fc8691710eccfb27a8

    • SHA1

      9b06af24a62d2760dbddc2ee7be531796c8552f8

    • SHA256

      7bf94324bf7ffd68800911283340439b03bcdbf5a97d45daed22f84b4f9883eb

    • SHA512

      3d65448493d8db946a30e129af0792a88d3093c544ec5b98118ff09b854055caa7558f12f334b0c350605c9a44fcf837992025ced5bdfea5657230ac2d165286

    • SSDEEP

      6144:XtgTFlqteWTBa5WsoUReNsyLK9d8WqniKS9jyA9yjHHXsBcfmL/p+LIORL6qYFYM:d8z4TU5WsoURzN9WtniPHlQEFYM

    Score
    10/10
    qakbotobama2101665041236bankerstealertrojan
    behavioral3behavioral4

    • Target

      Overdue.lnk

    • Size

      1KB

    • MD5

      62ba90eccd4951f50c79d95a479bfb4e

    • SHA1

      c98c5354e1d76a80183f296f76fa8868fa375d90

    • SHA256

      597dce062ac3a05e9d839bb7da4e70862d30ec7982a06fb219093a75018c1080

    • SHA512

      e733ae6b7a6971f72c49115f75e8e93bc214ae840dc68e0f5022322eba1c4fc2f9e4c274a703b55ae05035512c06ae8abfc2465fb603904678abb2ec51043576

    Score
    3/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks