qakbot | 6bc3735194028e1ed850050906d5ff02ceabdcf31825e754af9d0c6580686c86 | Triage

Sharing

General

Target

request.zip
Size

71KB
Sample

210204-3bn6y5btya
MD5

5b560f0bb43e17a3ab6172e3b33936c4
SHA1

7c0c3807564fea9324e5d21ff120be119e59d202
SHA256

6bc3735194028e1ed850050906d5ff02ceabdcf31825e754af9d0c6580686c86
SHA512

9f1136d87fa82ad7772454e23c8569a750b34234acf77d570cadc1ed99f79499b9ca1bbd23b449d36745d311f3c3f6c3c986fdc1a1d78191cd8bfbdd375fd772

Score

10^/10

qakbot krk01 1611569149 banker macro ransomware stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Targets

- Target
  
  deed contract 02.21.doc
- Size
  
  78KB
- MD5
  
  636779c650b1fb2b2df8c1c4c2328988
- SHA1
  
  5836a2ece8a5e8bd925d116b46813c79d3d81a16
- SHA256
  
  e9bcec7f6c34f018cf215403445708627bb0bed3ba6d651c15e3ea6579f67d32
- SHA512
  
  9cd51dcb8e27d75c229189fa8a3f331808bd4702a95d16ee9a0e1ea47c12db9ba09488ed05d17b1c1aa7851d3ffd3da9110385560f1013944727701ebc920cfd
Score

10^/10

qakbot krk01 1611569149 banker ransomware stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates physical storage devices
  Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
  ransomware
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

System Information Discovery

Query Registry

Peripheral Device Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotkrk011611569149bankerransomwarestealertrojan