qakbot | b25738b1b6eefb5cfa926ef7b1e22ccc69fd87bc5c18846641758740cda6767b

General

Target

55555555555.jpg.dll
Size

2.4MB
Sample

201223-lradsecczn
MD5

24032c160585aecb2bbd25315b29815e
SHA1

8111227af7188c74d59507f19d52a9642ea376a8
SHA256

b25738b1b6eefb5cfa926ef7b1e22ccc69fd87bc5c18846641758740cda6767b
SHA512

b7d6c5a2b9ba8db5e9fef01a9e6dd4e50340b6b30a48db13a3c1b29bd7a2ac3a17ca3253750a220a993c3c438af0b729c27d5201f51e88128cd7f171e9b21dee

Score

10^/10

Malware Config

Extracted

Family

qakbot

Botnet

abc117

Campaign

1608719407

C2

41.39.134.183:443

113.193.187.2:995

90.188.91.57:995

176.181.247.197:443

78.191.87.198:20

83.110.241.182:443

93.149.167.254:2222

76.111.128.194:443

32.212.117.188:443

72.36.59.46:2222

68.186.192.69:443

94.98.248.152:443

105.226.38.36:443

92.154.83.96:2222

37.210.255.225:995

74.195.52.3:443

73.166.10.38:443

95.77.223.148:443

80.227.5.70:443

91.104.104.63:995

Targets

- Target
  
  55555555555.jpg.dll
- Size
  
  2.4MB
- MD5
  
  24032c160585aecb2bbd25315b29815e
- SHA1
  
  8111227af7188c74d59507f19d52a9642ea376a8
- SHA256
  
  b25738b1b6eefb5cfa926ef7b1e22ccc69fd87bc5c18846641758740cda6767b
- SHA512
  
  b7d6c5a2b9ba8db5e9fef01a9e6dd4e50340b6b30a48db13a3c1b29bd7a2ac3a17ca3253750a220a993c3c438af0b729c27d5201f51e88128cd7f171e9b21dee
Score

10^/10

qakbot abc117 1608719407 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2