qakbot | 11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78

Sharing

Copy URL Twitter E-mail

General

Target
11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78.bin
Size 707KB
Sample201218-t3jge62td6
SHA256 11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78
MD5 4eef064479e814f52fbb93e443e61841
SHA1 a687b1b13593aed25a7e51264a8980b9c8f1469e
SHA512 20a3974bca03814f89a502af8f66447b7836d244e073a81454b1432dc4b280ae62f99e91d01d30c2451f69f0d3913af6409c747b112889edd8191f8c29d04673
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Botnet

abc115

Campaign

1608200390

95.76.27.6:443
35.139.242.207:443
93.86.1.159:995
190.30.186.43:443
151.60.38.21:443
5.2.212.254:443
39.36.112.67:995
78.63.226.32:443
68.131.19.52:443
86.121.43.200:443
47.44.217.98:443
5.204.148.208:995
2.91.235.94:443
217.133.54.140:32100
86.121.3.80:443
82.76.47.211:443
5.193.148.126:2078
109.205.204.229:2222
82.12.157.95:995
45.77.115.208:2222
2.50.49.18:22
106.250.150.98:443
83.110.243.101:443
207.246.77.75:995
193.248.154.174:2222
103.76.160.110:443
184.179.14.130:22
203.106.116.190:443
103.102.100.78:2222
85.52.72.32:2222
81.133.234.36:2222
41.228.217.194:443
2.88.1.76:995
85.105.29.218:443
2.84.239.171:2222
37.210.255.225:443
45.118.216.157:443
2.50.88.125:995
90.61.38.208:2222
90.53.103.26:2222
72.66.47.70:443
197.90.131.100:32100
72.28.255.159:995
74.75.237.11:443
2.91.9.248:443
118.100.159.27:443
156.222.73.116:995
2.232.253.79:995
39.45.58.87:995
92.154.83.96:1194
197.51.82.115:995
24.27.82.216:2222
74.195.52.3:443
2.50.58.11:443
78.101.158.1:61201
117.241.53.243:443
50.244.112.90:443
182.161.6.57:3389
41.39.134.183:443
180.151.233.178:443
76.111.128.194:443
125.63.101.62:443
92.99.21.76:443
51.223.138.251:443
2.50.2.216:443
118.168.234.135:443
85.101.187.146:443
86.98.148.224:443
92.154.83.96:2078
151.73.121.136:443
92.154.83.96:2087
199.116.241.147:443
45.77.115.208:8443
90.23.117.67:2222
42.201.228.106:995
123.136.59.45:443
217.162.149.212:443
82.19.107.102:2222
149.28.101.90:8443
78.96.199.79:443
24.205.42.241:443
47.146.169.85:443
2.51.240.250:995
37.130.115.124:443
83.84.150.54:2222
120.150.218.241:995
197.135.0.85:443
120.150.218.241:443
46.53.127.8:443
71.117.132.169:443
72.36.59.46:2222
62.38.114.12:2222
102.185.13.89:443
216.201.162.158:443
208.99.100.129:443
71.67.24.178:2222
77.132.113.187:2222
93.177.144.236:443
105.184.50.206:443
41.239.176.145:993
85.72.255.119:2222
83.110.109.78:2222
156.213.71.157:443
90.201.21.58:443
108.190.194.146:2222
45.77.115.208:443
124.29.232.108:443
172.87.157.235:3389
83.110.13.182:2222
79.129.252.62:2222
203.45.104.33:443
197.161.154.132:443
41.205.16.222:443
39.32.48.63:995
79.117.172.82:443
197.49.109.229:995
185.126.8.98:995
105.198.236.99:443
185.163.221.77:2222
196.204.207.111:443
203.106.195.67:443
86.97.221.121:443
213.60.147.140:443
185.246.9.69:995
84.247.55.190:8443
5.193.106.230:2078
184.189.122.72:443
189.150.111.8:2222
117.215.192.177:443
109.154.79.222:2222
78.101.130.59:995
217.128.117.218:2222
78.181.19.134:443
58.152.9.133:443
98.190.24.81:443
140.82.49.12:443
196.151.252.84:443
120.150.34.178:443
80.11.210.247:443
87.27.110.90:2222
217.52.224.138:995
79.114.236.11:443
156.220.79.90:995
86.122.248.164:2222
197.45.110.165:995
129.45.27.82:443
45.77.115.208:995
149.28.99.97:995
83.194.193.247:2222

Targets

- Target
  11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78.bin
- Size 707KB
- SHA256 11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78
- MD5 4eef064479e814f52fbb93e443e61841
- SHA1 a687b1b13593aed25a7e51264a8980b9c8f1469e
- SHA512 20a3974bca03814f89a502af8f66447b7836d244e073a81454b1432dc4b280ae62f99e91d01d30c2451f69f0d3913af6409c747b112889edd8191f8c29d04673
- MD5 SHA1 SHA512
Score

10^/10

qakbot abc115 1608200390 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2