General

  • Target

    b1f18c7fad0da8842863681a074c8a35_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240616-gae9vs1fqc

  • MD5

    b1f18c7fad0da8842863681a074c8a35

  • SHA1

    9e483f008a259c91f0be260a8a56e833a623dd89

  • SHA256

    92459aab5fc4c348f5a6a10fa7ce8bc734121a8e2d8d3c30e4337f74ae87017a

  • SHA512

    685cf77e17a93bf29e6a8f05c6ef18f72bb318f38b84cc466c86b665102769237771287efebc478cf13e615c5f5c2012007a7c5f6f1dd6f1c0a7cbb149950742

  • SSDEEP

    6144:9Ug69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6kr:q99trKTX84bkQfUO/aQdeMo3e+k4jACU

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc005

Campaign

1600415827

C2

50.244.112.10:995

207.237.1.152:443

184.97.148.2:443

207.255.161.8:993

69.167.206.238:50001

72.36.59.46:2222

173.26.189.151:443

2.50.59.177:443

217.162.149.212:443

199.247.22.145:443

203.106.195.67:443

109.154.214.224:2222

117.199.14.31:443

175.211.225.118:443

188.51.33.232:995

50.244.112.106:443

65.30.213.13:6882

24.37.178.158:443

47.28.131.209:443

207.255.161.8:995

Targets

    • Target

      b1f18c7fad0da8842863681a074c8a35_JaffaCakes118

    • Size

      1.1MB

    • MD5

      b1f18c7fad0da8842863681a074c8a35

    • SHA1

      9e483f008a259c91f0be260a8a56e833a623dd89

    • SHA256

      92459aab5fc4c348f5a6a10fa7ce8bc734121a8e2d8d3c30e4337f74ae87017a

    • SHA512

      685cf77e17a93bf29e6a8f05c6ef18f72bb318f38b84cc466c86b665102769237771287efebc478cf13e615c5f5c2012007a7c5f6f1dd6f1c0a7cbb149950742

    • SSDEEP

      6144:9Ug69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6kr:q99trKTX84bkQfUO/aQdeMo3e+k4jACU

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks