Where is the Origin QAKBOT Uses Valid Code Signing
Tags
country: Czechia
attack-pattern: Data Code Signing - T1553.002 Code Signing Certificates - T1587.002 Code Signing Certificates - T1588.003 Hardware - T1592.001 Malware - T1587.001 Malware - T1588.001 Private Keys - T1552.004 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 Code Signing - T1116 Private Keys - T1145
Show in Graph
Common Information
Type Value
UUID 96320510-36be-4d55-a708-f268b5f47e00
Fingerprint 657867bf1d39b784
Analysis status DONE
Considered CTI value 2
Text language
Published Oct. 27, 2022, midnight
Added to db Feb. 17, 2023, 11:18 p.m.
Last updated Nov. 17, 2024, 5:56 p.m.
Headline Where is the Origin?: QAKBOT Uses Valid Code Signing
Title Where is the Origin QAKBOT Uses Valid Code Signing
Detected Hints/Tags/Attributes 58/2/8
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_us/research/22/j/where-is-the-origin-qakbot-uses-valid-code-signing-.html
Details Source https://www.trendmicro.com/en_hk/research/22/j/where-is-the-origin-qakbot-uses-valid-code-signing-.html
Details Source https://www.trendmicro.com/en_ie/research/22/j/where-is-the-origin-qakbot-uses-valid-code-signing-.html
Details Source https://www.trendmicro.com/en_se/research/22/j/where-is-the-origin-qakbot-uses-valid-code-signing-.html
Details Source https://www.trendmicro.com/en_id/research/22/j/where-is-the-origin-qakbot-uses-valid-code-signing-.html
Details Source https://www.trendmicro.com/en_gb/research/22/j/where-is-the-origin-qakbot-uses-valid-code-signing-.html
Details Source https://www.trendmicro.com/en_fi/research/22/j/where-is-the-origin-qakbot-uses-valid-code-signing-.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Attributes
Details Type #Events CTI Value
Details CVE 172 
cve-2022-30190
Details sha256 2 
adadda4d61188c53c25323a3561db52d14a5dbb2585a53e18b33882f1013b9ee
Details sha256 2 
78bc13074087f93fcc8f11ae013995f9a366b6943330c3d02f0b50c4ae96c8a7
Details sha256 2 
42bc9b623f70e46d6aab4910d8c75221aecf89a00756a61b21f952eea13a446c
Details sha256 1 
37e973699f119ce5a2047281aa6f52429bc15164abdfe110f3340ee02d4c21b5
Details sha256 1 
362e56855844fb2be3dfae4b566ab676f6ec681fad1c1a2e8eb6d245d56b83f5
Details sha256 2 
20839bc89ca241bcd77ea69a2e36e40d7c1bd0dd91952502de8cd1db6fe771e1
Details sha256 1 
1beb6f15f403fe31392012b506ce1bb38424482d3e8123f0f80ae439484fffe7