qakbot | f0fe5eea010a9e693f28e58ddec1782ecaae69629f25a55b3a3d2b6842195b17 | Triage

Sharing

General

Target

filzqa.exe
Size

1.0MB
Sample

201115-apme3gly8x
MD5

ed5c967f6a2c13be4c74de0240f92a9e
SHA1

bb3d468e58fc42a94b9d4393dc91cce3a2446aba
SHA256

f0fe5eea010a9e693f28e58ddec1782ecaae69629f25a55b3a3d2b6842195b17
SHA512

8045bb1ee8c803adf44a78cb1590bc47adffb164c320e25fc529d2fd0d31c549fd82ca840382fd9cbd16c6cc786d84c38fe09d973eedca11baa831decdebf6ac

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Targets

- Target
  
  filzqa.exe
- Size
  
  1.0MB
- MD5
  
  ed5c967f6a2c13be4c74de0240f92a9e
- SHA1
  
  bb3d468e58fc42a94b9d4393dc91cce3a2446aba
- SHA256
  
  f0fe5eea010a9e693f28e58ddec1782ecaae69629f25a55b3a3d2b6842195b17
- SHA512
  
  8045bb1ee8c803adf44a78cb1590bc47adffb164c320e25fc529d2fd0d31c549fd82ca840382fd9cbd16c6cc786d84c38fe09d973eedca11baa831decdebf6ac
Score

10^/10

qakbot notset 1604404534 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Executes dropped EXE
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotnotset1604404534bankerstealertrojan