Overview

overview

10

Static

static

1

e49b9fb3fe...18.exe

windows7-x64

10

e49b9fb3fe...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e49b9fb3fec1f330b1c46b0d13b234b3_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240916-mt5xhstclm

  • MD5

    e49b9fb3fec1f330b1c46b0d13b234b3

  • SHA1

    90764eb97f33e80ce13eb28854612672e2eb37ac

  • SHA256

    71f24bd6e0a181c04f0fabc5801480a4e3991d2fdf8b35a72b1e91c60ba3eb03

  • SHA512

    624839c7472e7eb16c736e1c196bd7ea5590420c60a0179b66630aab47fd8ad3d9594479d3a93a3547c7b096cee7308ba75480c1ae66530ef27706c0e87b0bbf

  • SSDEEP

    6144:ImZY0vyoLlju376DEoS5rOA9xRK4VtJuchq+WPMJ/9BCa0KLDIHShQo5GTr:s0vgr6AoS5lxRKbcRWPa7Ca0Koos

Score
10/10
qakbotabc0071600776783bankerdiscoverystealertrojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc007

Campaign

1600776783

C2

72.204.242.138:20

207.255.161.8:443

5.12.0.239:443

207.255.161.8:2087

207.255.161.8:32103

117.218.208.239:443

72.204.242.138:53

141.156.232.157:443

47.146.169.85:443

74.75.216.202:443

173.22.125.129:2222

72.190.101.70:443

80.195.103.146:2222

84.78.128.76:2222

72.209.191.27:443

189.150.106.230:22

71.221.92.98:443

108.49.221.180:443

68.82.125.234:443

24.234.86.201:995

Targets

    • Target

      e49b9fb3fec1f330b1c46b0d13b234b3_JaffaCakes118

    • Size

      1.2MB

    • MD5

      e49b9fb3fec1f330b1c46b0d13b234b3

    • SHA1

      90764eb97f33e80ce13eb28854612672e2eb37ac

    • SHA256

      71f24bd6e0a181c04f0fabc5801480a4e3991d2fdf8b35a72b1e91c60ba3eb03

    • SHA512

      624839c7472e7eb16c736e1c196bd7ea5590420c60a0179b66630aab47fd8ad3d9594479d3a93a3547c7b096cee7308ba75480c1ae66530ef27706c0e87b0bbf

    • SSDEEP

      6144:ImZY0vyoLlju376DEoS5rOA9xRK4VtJuchq+WPMJ/9BCa0KLDIHShQo5GTr:s0vgr6AoS5lxRKbcRWPa7Ca0Koos

    Score
    10/10
    qakbotabc0071600776783bankerdiscoverystealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks