General

  • Target

    9784964314a873f959b016ed50dff5c5_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240605-jlcn8aag75

  • MD5

    9784964314a873f959b016ed50dff5c5

  • SHA1

    c2dcf36fcd305e11877fbb6a80c60b16bf3aa4bd

  • SHA256

    e6e67623e24b8c95021d63966ac7f2ba20e7fbe9495b32290871fc9fa8fe4fe3

  • SHA512

    965d36ad8474bf777ac77fc62e82007483c97d969077bf6bb490f6899a9150cca3c8fa9554d4ab661109d7c29a79c54421d4916a45219d3080437ac71a7a6676

  • SSDEEP

    6144:GUg69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6k+:Z99trKTX84bkQfUO/aQdeMo3e+k4jACJ

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc005

Campaign

1600415827

C2

50.244.112.10:995

207.237.1.152:443

184.97.148.2:443

207.255.161.8:993

69.167.206.238:50001

72.36.59.46:2222

173.26.189.151:443

2.50.59.177:443

217.162.149.212:443

199.247.22.145:443

203.106.195.67:443

109.154.214.224:2222

117.199.14.31:443

175.211.225.118:443

188.51.33.232:995

50.244.112.106:443

65.30.213.13:6882

24.37.178.158:443

47.28.131.209:443

207.255.161.8:995

Targets

    • Target

      9784964314a873f959b016ed50dff5c5_JaffaCakes118

    • Size

      1.1MB

    • MD5

      9784964314a873f959b016ed50dff5c5

    • SHA1

      c2dcf36fcd305e11877fbb6a80c60b16bf3aa4bd

    • SHA256

      e6e67623e24b8c95021d63966ac7f2ba20e7fbe9495b32290871fc9fa8fe4fe3

    • SHA512

      965d36ad8474bf777ac77fc62e82007483c97d969077bf6bb490f6899a9150cca3c8fa9554d4ab661109d7c29a79c54421d4916a45219d3080437ac71a7a6676

    • SSDEEP

      6144:GUg69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6k+:Z99trKTX84bkQfUO/aQdeMo3e+k4jACJ

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks