Overview

overview

10

Static

static

1

ddf932f409...18.exe

windows7-x64

10

ddf932f409...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ddf932f409cd8d649618fd8aedaef56d_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240913-jg55zascra

  • MD5

    ddf932f409cd8d649618fd8aedaef56d

  • SHA1

    558d33ef044455fac798b2a047dee5aa2c1ad31b

  • SHA256

    28a2431ffd24d8041bdbf471fcc3eebb98c9e53c980617e4c468f7ad9cdf9d31

  • SHA512

    08a80671f29c5776a936a48e8e4a481a20004c1ff9e54e683812df20918cf8a73897fed302543c0bd961a9f3e36be2a4113dd38b5a31971d3b6ae32225d68409

  • SSDEEP

    6144:MmZY0vyoLlju376DEoS5rOA9xRK4VtJuchq+WPMJ/9BCa0KLDIHShQo5G3g:o0vgr6AoS5lxRKbcRWPa7Ca0Koo/

Score
10/10
qakbotabc0071600776783bankerdiscoverystealertrojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc007

Campaign

1600776783

C2

72.204.242.138:20

207.255.161.8:443

5.12.0.239:443

207.255.161.8:2087

207.255.161.8:32103

117.218.208.239:443

72.204.242.138:53

141.156.232.157:443

47.146.169.85:443

74.75.216.202:443

173.22.125.129:2222

72.190.101.70:443

80.195.103.146:2222

84.78.128.76:2222

72.209.191.27:443

189.150.106.230:22

71.221.92.98:443

108.49.221.180:443

68.82.125.234:443

24.234.86.201:995

Targets

    • Target

      ddf932f409cd8d649618fd8aedaef56d_JaffaCakes118

    • Size

      1.2MB

    • MD5

      ddf932f409cd8d649618fd8aedaef56d

    • SHA1

      558d33ef044455fac798b2a047dee5aa2c1ad31b

    • SHA256

      28a2431ffd24d8041bdbf471fcc3eebb98c9e53c980617e4c468f7ad9cdf9d31

    • SHA512

      08a80671f29c5776a936a48e8e4a481a20004c1ff9e54e683812df20918cf8a73897fed302543c0bd961a9f3e36be2a4113dd38b5a31971d3b6ae32225d68409

    • SSDEEP

      6144:MmZY0vyoLlju376DEoS5rOA9xRK4VtJuchq+WPMJ/9BCa0KLDIHShQo5G3g:o0vgr6AoS5lxRKbcRWPa7Ca0Koo/

    Score
    10/10
    qakbotabc0071600776783bankerdiscoverystealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks