qakbot | c816a9d41ae027ee8174280428c5bb7fd9dfee449c461e04c2c71ce04358ed9b | Triage

Sharing

General

Target

approximate (50).zip
Size

271KB
Sample

210218-b4y7wvqgqs
MD5

342a156a492fb92db334c262720482c8
SHA1

dda9054329162761acf103f93767d8a9cdb550da
SHA256

c816a9d41ae027ee8174280428c5bb7fd9dfee449c461e04c2c71ce04358ed9b
SHA512

5350a1dfa543b8c9c8cb0a2a7d05528771bac645651958274ff4e0c442ddb7025b725622820cf003228656a0a1a8a83ab5d185f2575a683280e7ac04c7b8d340

Score

10^/10

qakbot tr 1613385567 banker macro stealer trojan xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://spititourism.com/ds/1702.gif

Extracted

Family

qakbot

Botnet

tr

Campaign

1613385567

C2

78.63.226.32:443

197.51.82.72:443

193.248.221.184:2222

95.77.223.148:443

71.199.192.62:443

77.211.30.202:995

80.227.5.69:443

77.27.204.204:995

81.97.154.100:443

173.184.119.153:995

38.92.225.121:443

81.150.181.168:2222

90.65.236.181:2222

83.110.103.152:443

73.153.211.227:443

188.25.63.105:443

89.137.211.239:995

202.188.138.162:443

98.173.34.212:995

87.202.87.210:2222

Targets

- Target
  
  document-2137773008.xls
- Size
  
  315KB
- MD5
  
  c4971cda610bf3a984b812bf0eef8d92
- SHA1
  
  b0c5a877b20bb8bf3df20f36e5e93ec85e2e78d3
- SHA256
  
  ff5d51cc097fc1e60ecda0894d9c16b52e40ef17cd22b3f62e2f10013aa7f37c
- SHA512
  
  0692b44fa1bb88249543340035ccfd8f8d91464a716fbef25890d78dadd530d3781d737c9b4a987ab8ccba4506514b07429db4bb89a06caf690c2ffbce5610f3
Score

10^/10

qakbot tr 1613385567 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

qakbottr1613385567bankerstealertrojan