Overview

overview

10

Static

static

3

41ffecc1aa...18.dll

windows7-x64

10

41ffecc1aa...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41ffecc1aa0e59d0e22bcf44c0f66a12_JaffaCakes118

  • Size

    573KB

  • Sample

    240713-re6ygswbpb

  • MD5

    41ffecc1aa0e59d0e22bcf44c0f66a12

  • SHA1

    232a64e4ff7a42769028c527b738a1b80e3e8ff6

  • SHA256

    ef64f344af3c324ac8f38b985abb0a794b27c97863b40ad597dfbb9217a2a115

  • SHA512

    d2dca18b0de89acf329669f635f39e1ebaca15af1d63d3910506e3186324ce67ff211dc674dce095e96566a00f5b3eb90ba2e3a2b8999fb07be42fc2cf08449b

  • SSDEEP

    12288:R87H3sH2k/eh9A9tqKsuud0jl0pT7fEztxG9HBMbVNAjirS:RSs7/uYtqkE3MzO9HoHos

Score
10/10
qakbotobama1071633078880bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

C2

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      41ffecc1aa0e59d0e22bcf44c0f66a12_JaffaCakes118

    • Size

      573KB

    • MD5

      41ffecc1aa0e59d0e22bcf44c0f66a12

    • SHA1

      232a64e4ff7a42769028c527b738a1b80e3e8ff6

    • SHA256

      ef64f344af3c324ac8f38b985abb0a794b27c97863b40ad597dfbb9217a2a115

    • SHA512

      d2dca18b0de89acf329669f635f39e1ebaca15af1d63d3910506e3186324ce67ff211dc674dce095e96566a00f5b3eb90ba2e3a2b8999fb07be42fc2cf08449b

    • SSDEEP

      12288:R87H3sH2k/eh9A9tqKsuud0jl0pT7fEztxG9HBMbVNAjirS:RSs7/uYtqkE3MzO9HoHos

    Score
    10/10
    qakbotobama1071633078880bankerevasionstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks