qakbot | 67f4b435976699fd651b479095f96ae516204f206d3a46e562acf47d695a9363

General

Target

ebcee12d69a8a77b2383984520132bd5.dll
Size

1.6MB
Sample

210109-469j27e826
MD5

ebcee12d69a8a77b2383984520132bd5
SHA1

0d309e74afac899e842357dd785f54d8824193f5
SHA256

67f4b435976699fd651b479095f96ae516204f206d3a46e562acf47d695a9363
SHA512

6aa395b29c736bf64d219e4f2fd5754156e065b6accf38ac8d00d9a4b96a5af38501849ba801b0b36e304b39776010c3829c0794eb46ff71c3a14d6a1d897986

Score

10^/10

Malware Config

Extracted

Family

qakbot

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Targets

- Target
  
  ebcee12d69a8a77b2383984520132bd5.dll
- Size
  
  1.6MB
- MD5
  
  ebcee12d69a8a77b2383984520132bd5
- SHA1
  
  0d309e74afac899e842357dd785f54d8824193f5
- SHA256
  
  67f4b435976699fd651b479095f96ae516204f206d3a46e562acf47d695a9363
- SHA512
  
  6aa395b29c736bf64d219e4f2fd5754156e065b6accf38ac8d00d9a4b96a5af38501849ba801b0b36e304b39776010c3829c0794eb46ff71c3a14d6a1d897986
Score

10^/10

qakbot abc117 1608747966 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2