Overview

overview

10

Static

static

9

file1.exe

windows7_x64

10

file1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file1.exe

  • Size

    1.1MB

  • Sample

    201109-k4bpy49n6a

  • MD5

    0c5d9a27daa00d234af1a30882aacc50

  • SHA1

    ac369d06c81af9d663e135a04dc94e582a0604fb

  • SHA256

    faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466

  • SHA512

    4f16b17d05359863da6e8128215d68532f81350b339167469174993064451fc1f7b2fbe9af0d58c43e04611ac7912369f8af9f59092305b4ca7390a93066a7d9

Score
10/10
qakbotspx1351591627649bankercryptoneevasionpackerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

spx135

Campaign

1591627649

C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

Targets

    • Target

      file1.exe

    • Size

      1.1MB

    • MD5

      0c5d9a27daa00d234af1a30882aacc50

    • SHA1

      ac369d06c81af9d663e135a04dc94e582a0604fb

    • SHA256

      faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466

    • SHA512

      4f16b17d05359863da6e8128215d68532f81350b339167469174993064451fc1f7b2fbe9af0d58c43e04611ac7912369f8af9f59092305b4ca7390a93066a7d9

    Score
    10/10
    qakbotspx1351591627649bankercryptonepackerstealertrojanevasion

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Turns off Windows Defender SpyNet reporting

      evasion

    • Windows security bypass

      evasiontrojan

    • CryptOne packer

      Detects CryptOne packer defined in NCC blogpost.

      cryptonepacker

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks