Overview

overview

10

Static

static

3

7058abeb6f...18.dll

windows7-x64

10

7058abeb6f...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118

  • Size

    573KB

  • Sample

    240725-tvrvlsthje

  • MD5

    7058abeb6f7d4a69c47fd8fa59a0abcf

  • SHA1

    64626a76a5f0d8629c67bc1d0e08f09ad0121484

  • SHA256

    38e719c1c9a05a97509a8fd8ed2a5b784839f945a211bddc7f7bbd9eb4b36c18

  • SHA512

    ba3eb479a00fb46d6bbbfd85bdcf0b55c2b4cdb3b4be9d5b804706b4e7dfd69a7291c4029bad3c40427193caed4b7b3dad18a5772b29abb51fce5dfec63d0206

  • SSDEEP

    12288:q87H3sH2k/es9A9tqKsuud0/l0pT7fEztxG9HBMbVNAzirS:qSs7/3Ytq4E3MzO9HoHos

Score
10/10
qakbotobama1071633078880bankerdiscoveryevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

C2

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118

    • Size

      573KB

    • MD5

      7058abeb6f7d4a69c47fd8fa59a0abcf

    • SHA1

      64626a76a5f0d8629c67bc1d0e08f09ad0121484

    • SHA256

      38e719c1c9a05a97509a8fd8ed2a5b784839f945a211bddc7f7bbd9eb4b36c18

    • SHA512

      ba3eb479a00fb46d6bbbfd85bdcf0b55c2b4cdb3b4be9d5b804706b4e7dfd69a7291c4029bad3c40427193caed4b7b3dad18a5772b29abb51fce5dfec63d0206

    • SSDEEP

      12288:q87H3sH2k/es9A9tqKsuud0/l0pT7fEztxG9HBMbVNAzirS:qSs7/3Ytq4E3MzO9HoHos

    Score
    10/10
    qakbotobama1071633078880bankerdiscoveryevasionstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks