qakbot | 32f6be13445516dcad76ef85489e9f5bf1e999002c5b9e3aa60fb1e2705d0c5e | Triage

Sharing

General

Target

ydpyfw.exe
Size

1.9MB
Sample

201117-jwnmf5ccp2
MD5

cac7a978bac4ec847e649e61d20cd67a
SHA1

ce9bc23c979743240e0191efa25cdb4052a21b79
SHA256

32f6be13445516dcad76ef85489e9f5bf1e999002c5b9e3aa60fb1e2705d0c5e
SHA512

6d55c2b0bec116eec63189814cd7ca4942d894291ef200aa4d541b604f9d8c691bcf77fffd5c247d3d6e55eb84236c0ffd071442c3667226ef88b6239a7a4e4b

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Targets

- Target
  
  ydpyfw.exe
- Size
  
  1.9MB
- MD5
  
  cac7a978bac4ec847e649e61d20cd67a
- SHA1
  
  ce9bc23c979743240e0191efa25cdb4052a21b79
- SHA256
  
  32f6be13445516dcad76ef85489e9f5bf1e999002c5b9e3aa60fb1e2705d0c5e
- SHA512
  
  6d55c2b0bec116eec63189814cd7ca4942d894291ef200aa4d541b604f9d8c691bcf77fffd5c247d3d6e55eb84236c0ffd071442c3667226ef88b6239a7a4e4b
Score

10^/10

qakbot notset 1604404534 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Executes dropped EXE
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotnotset1604404534bankerstealertrojan