qakbot | 57cbd897236778fb796ee26f3e9a44b05c069d259f40348d2b839d006115ea61

General

Target

55555555555.dll
Size

2.5MB
Sample

201225-cpswhckh5j
MD5

9fc08503c9df295325fe03eb0a631885
SHA1

e580906e08783f7925b722e2e143cb76ae257cab
SHA256

57cbd897236778fb796ee26f3e9a44b05c069d259f40348d2b839d006115ea61
SHA512

67e041a7dff7630f9dd55ae218aefda40c346ce38cf28cb2ecc87f1036d6a2da9b4b3234de8b656e99cfce4baf5e4b67b237b13ec8c54f50d1e9b966f22d5c4e

Score

10^/10

Malware Config

Extracted

Family

qakbot

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Targets

- Target
  
  55555555555.dll
- Size
  
  2.5MB
- MD5
  
  9fc08503c9df295325fe03eb0a631885
- SHA1
  
  e580906e08783f7925b722e2e143cb76ae257cab
- SHA256
  
  57cbd897236778fb796ee26f3e9a44b05c069d259f40348d2b839d006115ea61
- SHA512
  
  67e041a7dff7630f9dd55ae218aefda40c346ce38cf28cb2ecc87f1036d6a2da9b4b3234de8b656e99cfce4baf5e4b67b237b13ec8c54f50d1e9b966f22d5c4e
Score

10^/10

qakbot abc117 1608747966 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2