Overview

overview

10

Static

static

88888.png.exe

windows7_x64

10

88888.png.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88888.png

  • Size

    1.8MB

  • Sample

    200514-44s3b11xy2

  • MD5

    91c653d8be86925639e6a3e1cbb64055

  • SHA1

    ccde520c51ebcc5bcd687c82a58a3b43cac16a94

  • SHA256

    cf8aed3f7968ff1ad45466321592572fa4c6b6933766c810b7d89731bba6a6a7

  • SHA512

    05029a18f9822991c2c0c1540050331affb7c1413a20f08ffa08de9a529a148cc85a0f6771dadaa29dc25f0bb4f2d352b6796fd55540df037cb2ccbde4205237

Score
10/10
qakbotspx1111588597375bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

spx111

Campaign

1588597375

C2

98.22.234.245:443

188.173.70.18:443

189.159.19.223:995

73.60.148.209:443

74.105.139.160:443

50.244.112.106:443

47.232.26.181:443

50.104.186.71:443

173.172.205.216:443

208.126.142.17:443

71.197.31.92:0

72.240.65.85:443

24.183.39.93:443

73.137.187.150:443

74.135.85.117:443

172.87.134.226:443

201.146.188.44:443

76.170.77.99:443

67.170.137.8:443

24.55.152.50:995

Targets

    • Target

      88888.png

    • Size

      1.8MB

    • MD5

      91c653d8be86925639e6a3e1cbb64055

    • SHA1

      ccde520c51ebcc5bcd687c82a58a3b43cac16a94

    • SHA256

      cf8aed3f7968ff1ad45466321592572fa4c6b6933766c810b7d89731bba6a6a7

    • SHA512

      05029a18f9822991c2c0c1540050331affb7c1413a20f08ffa08de9a529a148cc85a0f6771dadaa29dc25f0bb4f2d352b6796fd55540df037cb2ccbde4205237

    Score
    10/10
    evasiontrojanbankerstealerqakbot

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Turns off Windows Defender SpyNet reporting

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks