Overview

overview

10

Static

static

3

43f5915cd6...54.xll

windows7-x64

10

43f5915cd6...54.xll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43f5915cd6cbf87bf2d5a3d19743a0bbd2cd6f2d7287e76777b0853bd2c15754

  • Size

    589KB

  • Sample

    241204-1ja62sykfp

  • MD5

    35825efb8c006f5a369710852b11230b

  • SHA1

    c9044fb0eba7e5ac56fc853d07830ec3c551e932

  • SHA256

    43f5915cd6cbf87bf2d5a3d19743a0bbd2cd6f2d7287e76777b0853bd2c15754

  • SHA512

    558eb36fe2d79e84d9c648532d575feb4c63aa22812ff03cbfcbfaad5c42a99597d00903aebdfde38c9ae4a75557df6ea5718b01387e02310f5c400ba239c1e2

  • SSDEEP

    6144:8cTaT6oGCNIamrNSYVnttpONtX7EmG2dOdQRG8l/dmMF7VndLmmmmmmm644tkw95:fVpSIm3OdQwgvpVndf42HXDiuJTMw4

Score
10/10
qakbotobama2421678805546bankerdiscoverystealertrojan

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

qakbot

Version

404.266

Botnet

obama242

Campaign

1678805546

C2

92.239.81.124:443

176.202.46.81:443

2.49.58.47:2222

86.225.214.138:2222

74.66.134.24:443

213.31.90.183:2222

12.172.173.82:50001

202.187.87.178:995

70.53.96.223:995

92.154.45.81:2222

186.64.67.54:443

81.158.112.20:2222

190.191.35.122:443

68.173.170.110:8443

12.172.173.82:993

98.145.23.67:443

12.172.173.82:22

37.186.55.60:2222

84.216.198.124:6881

73.161.176.218:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      43f5915cd6cbf87bf2d5a3d19743a0bbd2cd6f2d7287e76777b0853bd2c15754

    • Size

      589KB

    • MD5

      35825efb8c006f5a369710852b11230b

    • SHA1

      c9044fb0eba7e5ac56fc853d07830ec3c551e932

    • SHA256

      43f5915cd6cbf87bf2d5a3d19743a0bbd2cd6f2d7287e76777b0853bd2c15754

    • SHA512

      558eb36fe2d79e84d9c648532d575feb4c63aa22812ff03cbfcbfaad5c42a99597d00903aebdfde38c9ae4a75557df6ea5718b01387e02310f5c400ba239c1e2

    • SSDEEP

      6144:8cTaT6oGCNIamrNSYVnttpONtX7EmG2dOdQRG8l/dmMF7VndLmmmmmmm644tkw95:fVpSIm3OdQwgvpVndf42HXDiuJTMw4

    Score
    10/10
    qakbotobama2421678805546bankerdiscoverystealertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Qakbot family

      qakbot

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks