General

  • Target

    96d539a4315a3316456c73b4d5c89f11_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240605-bcsebahc7s

  • MD5

    96d539a4315a3316456c73b4d5c89f11

  • SHA1

    b272ed8e3f82c1cdd93c2947b2e9501ee2d32bda

  • SHA256

    45bd22771aeaab651a6ff5a3a23193446ffd305472082d06ad6612878fa2786e

  • SHA512

    7ec5467c05a187dc0bb6b61731e5841a2b2e226cfeecedde6101663740ad2ab0a4ae7f40adeb2fd54a64ec7b8181cf48f8a878f9f9c032c740a2f8ff0f4e3d39

  • SSDEEP

    6144:KUg69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6kV:V99trKTX84bkQfUO/aQdeMo3e+k4jACy

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc005

Campaign

1600415827

C2

50.244.112.10:995

207.237.1.152:443

184.97.148.2:443

207.255.161.8:993

69.167.206.238:50001

72.36.59.46:2222

173.26.189.151:443

2.50.59.177:443

217.162.149.212:443

199.247.22.145:443

203.106.195.67:443

109.154.214.224:2222

117.199.14.31:443

175.211.225.118:443

188.51.33.232:995

50.244.112.106:443

65.30.213.13:6882

24.37.178.158:443

47.28.131.209:443

207.255.161.8:995

Targets

    • Target

      96d539a4315a3316456c73b4d5c89f11_JaffaCakes118

    • Size

      1.1MB

    • MD5

      96d539a4315a3316456c73b4d5c89f11

    • SHA1

      b272ed8e3f82c1cdd93c2947b2e9501ee2d32bda

    • SHA256

      45bd22771aeaab651a6ff5a3a23193446ffd305472082d06ad6612878fa2786e

    • SHA512

      7ec5467c05a187dc0bb6b61731e5841a2b2e226cfeecedde6101663740ad2ab0a4ae7f40adeb2fd54a64ec7b8181cf48f8a878f9f9c032c740a2f8ff0f4e3d39

    • SSDEEP

      6144:KUg69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6kV:V99trKTX84bkQfUO/aQdeMo3e+k4jACy

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks