Overview

overview

10

Static

static

3

678fd0c9e3...4d.exe

windows10-2004-x64

10

678fd0c9e3...4d.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_14569038355_sality.zip
  • Size 694KB
  • Sample260917-wt5q7ahn3w
  • SHA256 73683dcdfb8535d839e4f0edc7d4c3cfee71de6a93c53e130f744ae4cd5b5abc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
qakbotbmw011706268333bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Botnet

  • bmw01

Campaign

  • 1706268333

C2

  • 116.202.110.87:443

  • 77.73.39.175:32103

  • 185.156.172.62:443

  • 185.117.90.142:6882

Attributes
  • camp_date

    2024-01-26 11:25:33 +0000 UTC

Targets

    • Target
      678fd0c9e3eb849db27b2e005af7c1015adfdd77fd1e4d7a10ce45bd26490a4d
    • Size 1.3MB
    • SHA256 678fd0c9e3eb849db27b2e005af7c1015adfdd77fd1e4d7a10ce45bd26490a4d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankerbmw011706268333qakbotstealertrojan

    • Detect Qakbot Payload

    • Family: Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks