Overview

overview

10

Static

static

MSG_986000.vbs

windows7_x64

10

MSG_986000.vbs

windows10_x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    MSG_986000.vbs
  • Size 5.2MB
  • Sample200303-bdsch48nyx
  • SHA256 d41c66a9160ce7f0dd0d1360d8b8339a8276fc30215f4623ca88d0efad319346
  • MD5 SHA1 SHA512
Score
10/10
qakbotbankerpersistencestealertrojan

Malware Config

Targets

    • Target
      MSG_986000.vbs
    • Size 5.2MB
    • SHA256 d41c66a9160ce7f0dd0d1360d8b8339a8276fc30215f4623ca88d0efad319346
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbankerstealerqakbotpersistence

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks