qakbot | dd68914c1082dc3a17171c8e6f81330058db042bba3b6dc78da3d304bc78bcd2 | Triage

Sharing

General

Target

certificate 02.21.doc
Size

96KB
Sample

210203-1j7szsxama
MD5

615b4a33d5ee7d3833430c54acec1a2a
SHA1

fdc6f96cf299966b467052a37d548caa4e7428c6
SHA256

dd68914c1082dc3a17171c8e6f81330058db042bba3b6dc78da3d304bc78bcd2
SHA512

f6dca8c6f8ffc6e7c119ea057f008c6913c304612b3900e18ea9c70decebc8c9966b71ddb7c8a6d1f2c25c6b17bb893792d2a7269ace4092d4463f99a8ae553b

Score

10^/10

qakbot krk01 1611569149 banker macro stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Targets

- Target
  
  certificate 02.21.doc
- Size
  
  96KB
- MD5
  
  615b4a33d5ee7d3833430c54acec1a2a
- SHA1
  
  fdc6f96cf299966b467052a37d548caa4e7428c6
- SHA256
  
  dd68914c1082dc3a17171c8e6f81330058db042bba3b6dc78da3d304bc78bcd2
- SHA512
  
  f6dca8c6f8ffc6e7c119ea057f008c6913c304612b3900e18ea9c70decebc8c9966b71ddb7c8a6d1f2c25c6b17bb893792d2a7269ace4092d4463f99a8ae553b
Score

10^/10

qakbot krk01 1611569149 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

qakbotkrk011611569149bankerstealertrojan