Overview

overview

10

Static

static

Kaufvertra...20.vbs

windows7_x64

10

Kaufvertra...20.vbs

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Kaufvertrag_335774592927_20052020.vbs

  • Size

    36.2MB

  • Sample

    200524-vdjbk14fbx

  • MD5

    e4c51a265a25b187d92ce90b381aff5f

  • SHA1

    b95bb9ca726d717703880c340f7a5c3c3f5e7bed

  • SHA256

    a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44

  • SHA512

    de7ef4026401a3c371e58e3c40e63ed18adec9273a6c88e955eb32570e844f0b0cb640fd274eae0a485474f244ea1990cfd16bc47688e380a45015a81bc2e33c

Score
10/10
qakbotspx1241590052330bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

spx124

Campaign

1590052330

C2

188.173.185.139:443

117.241.53.130:443

81.103.144.77:443

217.219.50.172:990

103.76.160.110:443

68.204.164.222:443

98.32.60.217:443

173.245.152.231:443

72.240.245.253:443

112.171.126.153:443

141.85.114.172:443

31.5.189.71:443

71.77.231.251:443

72.190.101.70:443

140.82.21.191:443

31.5.41.52:443

78.188.109.130:443

70.124.29.226:443

24.43.22.220:993

101.108.114.66:443

Targets

    • Target

      Kaufvertrag_335774592927_20052020.vbs

    • Size

      36.2MB

    • MD5

      e4c51a265a25b187d92ce90b381aff5f

    • SHA1

      b95bb9ca726d717703880c340f7a5c3c3f5e7bed

    • SHA256

      a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44

    • SHA512

      de7ef4026401a3c371e58e3c40e63ed18adec9273a6c88e955eb32570e844f0b0cb640fd274eae0a485474f244ea1990cfd16bc47688e380a45015a81bc2e33c

    Score
    10/10
    trojanbankerstealerqakbot

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks