Overview

overview

10

Static

static

1

LisectAVT_...48.dll

windows7-x64

10

LisectAVT_...48.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LisectAVT_2403002C_48.dll

  • Size

    294KB

  • Sample

    240725-b8s1qathjc

  • MD5

    59a965662088f01d6f4db88c2ed2622a

  • SHA1

    e0858f41bc2ac452ee071eb9e097a40b185db0a0

  • SHA256

    d891201433c0dd4df1a83be629f03d8c30b5ff1d88710e6f41b7056c27d48fe2

  • SHA512

    bf91ad2d3f01237094bc23ba3737cb657fe62e588ceff5b63f196dd1ee49e2a0cbfc3e072ea83a9f4eda1a35edb7a73ebb5d7ef85528687234f1edf2c36509a6

  • SSDEEP

    3072:D3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZl:jvv9sMoXBaRmr/dukbvuZ/7fH

Score
10/10
qakbotabc1041606818862bankerdiscoverystealertrojan

Malware Config

Extracted

Family

qakbot

Version

401.51

Botnet

abc104

Campaign

1606818862

C2

79.119.124.237:443

87.218.53.206:2222

181.169.88.203:443

82.12.157.95:995

94.49.188.240:443

46.124.107.124:6881

86.122.248.164:2222

83.202.68.220:2222

79.129.216.215:2222

37.21.231.245:995

47.187.49.3:2222

2.90.33.130:443

149.28.98.196:995

149.28.99.97:443

45.63.107.192:995

149.28.98.196:2222

45.63.107.192:2222

74.73.27.35:443

149.28.98.196:443

144.202.38.185:2222
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      LisectAVT_2403002C_48.dll

    • Size

      294KB

    • MD5

      59a965662088f01d6f4db88c2ed2622a

    • SHA1

      e0858f41bc2ac452ee071eb9e097a40b185db0a0

    • SHA256

      d891201433c0dd4df1a83be629f03d8c30b5ff1d88710e6f41b7056c27d48fe2

    • SHA512

      bf91ad2d3f01237094bc23ba3737cb657fe62e588ceff5b63f196dd1ee49e2a0cbfc3e072ea83a9f4eda1a35edb7a73ebb5d7ef85528687234f1edf2c36509a6

    • SSDEEP

      3072:D3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZl:jvv9sMoXBaRmr/dukbvuZ/7fH

    Score
    10/10
    qakbotabc1041606818862bankerdiscoverystealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks