Overview

overview

10

Static

static

file1.bin.exe

windows7_x64

10

file1.bin.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file1.bin

  • Size

    1.2MB

  • Sample

    200608-brlc4nf3lx

  • MD5

    ba6e8aa94975c85cbe78166aa8bb1ba9

  • SHA1

    7d3d07c1ca51d3133aaf4bd2bc1287e19487bd87

  • SHA256

    5df0f7749580fcbf6251e0ae59b24c35a949c253c0f099f7f30bd2e66fcbf9b1

  • SHA512

    3757a04f43528ed6c7e79a54c354915fba39d377e64fcdc719039114c68cf7bda8c3bec171163e00d7d7747c56c7453ffe64c9c150fe21e8e09081bf428caa0b

Score
10/10
qakbotspx1351591627649bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

spx135

Campaign

1591627649

C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

Targets

    • Target

      file1.bin

    • Size

      1.2MB

    • MD5

      ba6e8aa94975c85cbe78166aa8bb1ba9

    • SHA1

      7d3d07c1ca51d3133aaf4bd2bc1287e19487bd87

    • SHA256

      5df0f7749580fcbf6251e0ae59b24c35a949c253c0f099f7f30bd2e66fcbf9b1

    • SHA512

      3757a04f43528ed6c7e79a54c354915fba39d377e64fcdc719039114c68cf7bda8c3bec171163e00d7d7747c56c7453ffe64c9c150fe21e8e09081bf428caa0b

    Score
    10/10
    trojanbankerstealerqakbotevasion

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Turns off Windows Defender SpyNet reporting

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks