qakbot | 84a0c818da5d2624e3c7cf0543cb8c6dbc1e90759681fdf87fe2aedd1950347b

Sharing

Copy URL Twitter E-mail

General

Target
Emotet_Qakbot.bin
Size 792KB
Sample200721-954zd44kb2
SHA256 84a0c818da5d2624e3c7cf0543cb8c6dbc1e90759681fdf87fe2aedd1950347b
MD5 604cd6de76c9fc7e2175925a86400fa8
SHA1 3f19636f09bcb728e7f348f195c80b28db3eb402
SHA512 b4a4c4da670f45ec3f88fa38cdfd0e6beb1d1dd9532e79eae432a81afa94c20fad35587837f51d2fa65c0e35976d9561c1ad6d15a8c2f00aff54b8c1123bf5d7
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Botnet

partner01

Campaign

1592498872

190.220.8.10:443
66.57.216.53:993
173.175.29.210:443
72.255.200.69:2222
24.229.150.54:995
81.133.234.36:2222
86.4.44.48:443
92.104.210.253:2222
71.56.53.127:443
174.85.133.130:2222
201.170.83.26:443
5.15.81.52:443
187.207.185.170:443
67.248.210.221:53
67.246.16.250:995
212.126.109.14:443
69.11.247.242:443
207.255.161.8:32100
69.92.54.95:995
104.235.72.17:443
200.113.201.83:995
82.81.172.21:443
74.134.46.7:443
151.73.125.195:443
188.24.214.244:443
188.192.75.8:443
24.165.87.61:443
216.163.4.132:443
174.34.67.106:2222
86.175.7.7:2222
72.142.106.198:995
68.190.152.98:443
47.24.47.218:443
73.217.4.42:443
96.244.45.155:443
72.240.245.253:443
130.25.130.19:2222
35.142.12.163:2222
98.240.24.57:443
95.77.144.238:443
67.8.103.21:443
80.195.103.146:2222
72.142.106.198:465
66.26.160.37:443
72.177.157.217:995
173.26.189.151:443
96.18.240.158:443
93.114.122.202:2222
207.246.71.122:443
144.202.48.107:443
45.77.215.141:443
173.173.1.164:443
100.40.48.96:443
76.106.25.207:443
74.222.204.82:443
72.88.119.131:443
108.30.125.94:443
100.19.7.242:443
172.78.30.215:443
66.208.105.6:443
95.77.223.148:443
72.190.101.70:443
24.183.39.93:443
72.228.3.116:443
24.139.132.70:443
68.200.23.189:443
172.242.156.50:995
24.202.42.48:2222
72.204.242.138:443
72.204.242.138:20
108.45.29.12:443
68.174.15.223:443
74.193.197.246:443
96.56.237.174:990
64.19.74.29:995
70.168.130.172:443
81.106.46.63:443
100.43.250.74:995
189.236.166.167:443
68.4.137.211:443
76.187.8.160:443
86.126.97.183:2222
24.90.160.91:443
76.86.57.179:2222
201.103.155.111:443
24.234.86.201:995
75.183.171.155:3389
98.148.177.77:443
173.172.205.216:443
98.116.62.242:443
74.215.201.122:443
173.3.132.17:995
73.226.220.56:443
207.255.161.8:32103
75.137.239.211:443
68.49.120.179:443
5.193.178.241:2078
206.51.202.106:50003
82.127.193.151:2222
207.255.161.8:2222
207.255.161.8:2087
24.152.219.253:995
41.97.138.74:443
104.173.119.54:2222
80.240.26.178:443
207.246.75.201:443
199.247.22.145:443
199.247.16.80:443
173.90.33.182:2222
79.114.199.39:443
80.14.209.42:2222
24.164.79.147:443
70.183.127.6:995
47.153.115.154:993
184.180.157.203:2222
87.65.204.240:995
217.162.149.212:443
50.104.68.223:443
195.162.106.93:2222
67.165.206.193:995
200.113.201.83:993
103.238.231.40:443
84.232.238.30:443
78.96.192.26:443
47.153.115.154:465
98.115.138.61:443
24.42.14.241:995
189.160.203.110:443
188.27.76.139:443
207.255.161.8:32102
49.207.105.25:443
193.248.44.2:2222
190.63.182.214:443
179.51.23.31:443
74.135.37.79:443
208.82.44.203:443
71.210.177.4:443
83.110.222.11:443
187.155.74.5:995
50.244.112.106:443
193.23.5.134:443
78.102.138.103:995
2.50.47.97:2222
201.248.102.4:2078
41.34.91.90:995
72.204.242.138:53
46.214.62.199:443
201.127.27.88:443
68.46.142.48:443
72.29.181.77:2078

Targets

- Target
  Emotet_Qakbot.bin
- Size 792KB
- SHA256 84a0c818da5d2624e3c7cf0543cb8c6dbc1e90759681fdf87fe2aedd1950347b
- MD5 604cd6de76c9fc7e2175925a86400fa8
- SHA1 3f19636f09bcb728e7f348f195c80b28db3eb402
- SHA512 b4a4c4da670f45ec3f88fa38cdfd0e6beb1d1dd9532e79eae432a81afa94c20fad35587837f51d2fa65c0e35976d9561c1ad6d15a8c2f00aff54b8c1123bf5d7
- MD5 SHA1 SHA512
Score

10^/10

trojan banker stealer qakbot evasion
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Turns off Windows Defender SpyNet reporting
  evasion
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Turns off Windows Defender SpyNet reporting

Windows security bypass

Executes dropped EXE

Loads dropped DLL

Windows security modification

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2