qakbot | b78c608b6efdbcab010375b990d029eefd2aa139b5796cd5b10adf50a8e48ec3

Sharing

Copy URL Twitter E-mail

General

Target
999999png
Size 1.2MB
Sample200924-d3ghnt6fzx
SHA256 b78c608b6efdbcab010375b990d029eefd2aa139b5796cd5b10adf50a8e48ec3
MD5 99ba6611d0b2f899241103c21e15bf6f
SHA1 0080dac2144b43c242b875a7bdea7f9b2a5a13cc
SHA512 be4b66e0e922d3f285b609f8a7f08ec9452c0210153023fb7dc680c894a3a6a279614319126ea814d8f4e6790a7f96f9fa371b7a005f15eea4109db37b08ac19
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Botnet

abc008

Campaign

1600855273

77.30.99.99:995
122.165.181.76:995
72.28.255.159:995
108.46.145.30:443
45.77.193.83:443
207.246.75.201:443
108.5.34.248:443
203.198.96.200:443
188.52.107.171:995
184.96.141.112:993
74.129.24.163:443
24.218.181.15:443
197.57.51.59:443
217.162.149.212:443
24.27.82.216:2222
78.97.3.6:443
96.41.93.96:443
197.210.96.222:995
45.32.154.10:443
199.247.16.80:443
76.179.54.116:443
73.228.1.246:443
95.179.247.224:443
96.30.198.161:443
202.141.244.118:995
189.150.106.230:22
39.37.244.25:995
217.165.164.178:2222
51.223.53.162:443
95.77.144.238:443
93.149.253.201:2222
207.237.1.152:443
80.240.26.178:443
77.27.174.49:995
24.205.42.241:443
41.228.240.106:443
89.136.165.31:443
117.218.208.239:443
103.110.49.88:443
83.110.6.64:2222
209.182.122.217:443
75.165.38.209:50002
5.13.179.158:995
72.66.47.70:443
2.88.23.102:995
64.121.114.87:443
5.12.217.37:2222
86.98.89.73:2222
173.245.152.231:443
103.206.112.234:443
98.16.204.189:995
95.77.223.148:443
73.238.141.72:443
102.186.126.62:443
203.106.195.67:443
41.232.234.43:995
36.77.151.211:443
81.133.234.36:2222
151.73.116.80:443
46.53.38.139:443
41.97.86.137:443
45.32.155.12:443
68.46.142.48:995
172.112.163.197:2222
61.3.190.238:443
103.76.160.110:443
175.211.225.118:443
89.42.142.35:443
86.97.11.96:443
72.186.1.237:443
2.50.131.64:443
2.50.59.177:443
73.32.115.251:443
84.117.176.32:443
144.139.47.206:443
65.131.33.110:995
199.247.22.145:443
75.90.6.126:995
93.86.219.77:995
213.31.203.48:2222
2.89.114.174:995
109.154.214.224:2222
80.14.209.42:2222
185.246.9.69:995
94.52.160.116:443
173.21.10.71:2222
71.12.214.209:2222
74.73.27.35:443
95.76.31.12:443
188.26.182.94:443
47.138.201.136:443
81.103.144.77:443
148.75.231.53:443
73.136.242.114:443
108.30.125.94:443
71.217.125.53:2222
95.76.109.181:443
24.128.117.95:443
71.88.104.107:443
71.220.200.82:2222
65.102.149.94:995
75.189.159.193:443
69.123.116.167:2222
116.240.76.97:0
71.197.126.250:443
50.29.166.232:995
93.113.177.152:443
45.46.53.140:2222
96.37.113.36:993
24.28.183.107:995
74.195.88.59:995
189.157.199.133:995
66.76.105.197:443
68.184.45.73:443
68.104.6.221:993
96.237.141.134:995
75.82.182.228:2222
201.103.77.54:443
156.222.102.252:443
1.172.94.252:443
71.218.58.245:443
70.164.37.205:995
71.56.53.127:443
207.255.161.8:993
72.36.59.46:2222
98.240.24.57:443
99.240.226.2:443
69.11.247.242:443
65.30.213.13:6882
71.187.170.235:443
207.255.161.8:2078
207.255.161.8:32100
68.174.15.223:443
50.244.112.10:995
187.206.78.150:995
98.22.65.76:443
68.174.9.179:443
67.209.195.198:443
72.204.242.138:465
59.26.204.144:443
75.81.25.223:443
50.232.172.114:443
184.180.157.203:2222
24.231.54.185:2222
50.244.112.106:443
189.231.196.236:443
50.104.68.223:443
75.136.26.147:443
209.137.209.163:995
37.210.186.213:61201

Targets

- Target
  999999png
- Size 1.2MB
- SHA256 b78c608b6efdbcab010375b990d029eefd2aa139b5796cd5b10adf50a8e48ec3
- MD5 99ba6611d0b2f899241103c21e15bf6f
- SHA1 0080dac2144b43c242b875a7bdea7f9b2a5a13cc
- SHA512 be4b66e0e922d3f285b609f8a7f08ec9452c0210153023fb7dc680c894a3a6a279614319126ea814d8f4e6790a7f96f9fa371b7a005f15eea4109db37b08ac19
- MD5 SHA1 SHA512
Score

10^/10

trojan banker stealer qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2