Overview

overview

10

Static

static

3

986fd1563c...0N.dll

windows7-x64

10

986fd1563c...0N.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    986fd1563c4e35e12f4e7f271baa33a0N

  • Size

    1.0MB

  • Sample

    240825-3yvkcasfkf

  • MD5

    986fd1563c4e35e12f4e7f271baa33a0

  • SHA1

    a0df6b212f31096c1bfb25d74bfd9bb7e8a894b8

  • SHA256

    8c8527fd91452a4e01c3ec76bd5cbd1bd155f1f064137a343317a8e95e849153

  • SHA512

    33d811fd26d9ca80b0bde3e3be3e8c38cecebb0e2049cfb73a2d56e731def4c202b71ca0f7b39c430d682aea31e39d8df945969ff1250d3ed2f9c3415c66887d

  • SSDEEP

    6144:pwexqEM8055EX+dridb0+NCirQ6TBByIeJzt93S0EE8cuFA6EpnznituagDgwzyQ:2exF055EX+dW1VONPfzituaC9zbLV

Score
10/10
qakbotbiden511622109872bankerdiscoverystealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

biden51

Campaign

1622109872

C2

97.69.160.4:2222

96.37.113.36:993

50.244.112.106:443

172.78.43.46:443

47.22.148.6:443

197.45.110.165:995

71.187.170.235:443

75.67.192.125:443

96.61.23.88:995

140.82.49.12:443

81.97.154.100:443

122.58.117.81:995

105.198.236.99:443

68.186.192.69:443

92.59.35.196:2222

149.28.98.196:443

45.32.211.207:995

45.32.211.207:2222

45.77.115.208:2222

144.202.38.185:2222
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      986fd1563c4e35e12f4e7f271baa33a0N

    • Size

      1.0MB

    • MD5

      986fd1563c4e35e12f4e7f271baa33a0

    • SHA1

      a0df6b212f31096c1bfb25d74bfd9bb7e8a894b8

    • SHA256

      8c8527fd91452a4e01c3ec76bd5cbd1bd155f1f064137a343317a8e95e849153

    • SHA512

      33d811fd26d9ca80b0bde3e3be3e8c38cecebb0e2049cfb73a2d56e731def4c202b71ca0f7b39c430d682aea31e39d8df945969ff1250d3ed2f9c3415c66887d

    • SSDEEP

      6144:pwexqEM8055EX+dridb0+NCirQ6TBByIeJzt93S0EE8cuFA6EpnznituagDgwzyQ:2exF055EX+dW1VONPfzituaC9zbLV

    Score
    10/10
    qakbotbiden511622109872bankerdiscoverystealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks