Overview

overview

10

Static

static

qbot.dll

windows7_x64

10

qbot.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    qbot.dll

  • Size

    255KB

  • Sample

    201222-xrs957lgpx

  • MD5

    df1bfe7672d36827a458fa7dbf3bc2bb

  • SHA1

    98fd75c1624b525b4fb527d193a0adaba6d6b9e4

  • SHA256

    44e91f129e24afb6fe38bfa1436bf92f63d97c0b9f411854dde1bfbf498ea3e3

  • SHA512

    410ab89da086ccd9367b2c6d3b95b9f1dd42ffe456d8b4d9ad79ac7a0632709a558388361502fb3b1d763d66901d5247e8894e2801d5fa411763f834305b6bf8

Score
10/10
qakbotabc1011606294013bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

abc101

Campaign

1606294013

C2

98.115.243.237:443

78.101.21.73:443

185.163.221.77:2222

2.51.246.190:995

2.50.2.11:995

175.137.79.81:443

42.201.228.106:995

185.246.9.69:995

81.133.234.36:2222

24.205.42.241:443

73.239.229.107:995

102.185.58.126:443

173.245.152.231:443

105.101.216.210:443

89.137.195.167:995

174.76.21.134:443

41.238.217.126:6881

47.138.204.19:443

79.166.83.103:2222

92.154.83.96:1194

Targets

    • Target

      qbot.dll

    • Size

      255KB

    • MD5

      df1bfe7672d36827a458fa7dbf3bc2bb

    • SHA1

      98fd75c1624b525b4fb527d193a0adaba6d6b9e4

    • SHA256

      44e91f129e24afb6fe38bfa1436bf92f63d97c0b9f411854dde1bfbf498ea3e3

    • SHA512

      410ab89da086ccd9367b2c6d3b95b9f1dd42ffe456d8b4d9ad79ac7a0632709a558388361502fb3b1d763d66901d5247e8894e2801d5fa411763f834305b6bf8

    Score
    10/10
    qakbotabc1011606294013bankerstealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks