qakbot | 2c3f8cd9530f913ec89c40af384f9b2affe94db0d3bc0a38dd40a3ea20f335c4 | Triage

Sharing

General

Target

xkkcrg.exe
Size

1.0MB
Sample

201115-f89k4spd36
MD5

4a569c3ae8a151701b614a651a8807a0
SHA1

e251262c6efafd027d52b5fbae16d52ab236fd09
SHA256

2c3f8cd9530f913ec89c40af384f9b2affe94db0d3bc0a38dd40a3ea20f335c4
SHA512

70d1ba89053fad4f2125fcb381c788c8f9eac277ac718b016429637146d906d7e0dec8815279652a2cc4da22bc91e57d8d4da37cc7d9d193da9ab788b7b7e8d2

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Targets

- Target
  
  xkkcrg.exe
- Size
  
  1.0MB
- MD5
  
  4a569c3ae8a151701b614a651a8807a0
- SHA1
  
  e251262c6efafd027d52b5fbae16d52ab236fd09
- SHA256
  
  2c3f8cd9530f913ec89c40af384f9b2affe94db0d3bc0a38dd40a3ea20f335c4
- SHA512
  
  70d1ba89053fad4f2125fcb381c788c8f9eac277ac718b016429637146d906d7e0dec8815279652a2cc4da22bc91e57d8d4da37cc7d9d193da9ab788b7b7e8d2
Score

10^/10

qakbot notset 1604404534 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Executes dropped EXE
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotnotset1604404534bankerstealertrojan