qakbot | cc32bd471e363c94e4ac20d005ad49140b24049ddafc520d91e3cea34d93c8e1 | Triage

Sharing

General

Target

projected (99).zip
Size

271KB
Sample

210218-e61g38wyca
MD5

da4b540320f3f09c6f73b7f1f96d132e
SHA1

b790ced256ac157eb1c3449a3e71e4fd8cd398d3
SHA256

cc32bd471e363c94e4ac20d005ad49140b24049ddafc520d91e3cea34d93c8e1
SHA512

3d8ea01f13a8e391db5f298678b88f989ff9862b3d893755329a69e003354c97429944a2c40d1a469b5cca140fd0bb04f83e33013727f475efc2fe394ddd9a64

Score

10^/10

qakbot tr 1613385567 banker macro stealer trojan xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://intellectsmart.in/ds/1702.gif

Extracted

Family

qakbot

Botnet

tr

Campaign

1613385567

C2

78.63.226.32:443

197.51.82.72:443

193.248.221.184:2222

95.77.223.148:443

71.199.192.62:443

77.211.30.202:995

80.227.5.69:443

77.27.204.204:995

81.97.154.100:443

173.184.119.153:995

38.92.225.121:443

81.150.181.168:2222

90.65.236.181:2222

83.110.103.152:443

73.153.211.227:443

188.25.63.105:443

89.137.211.239:995

202.188.138.162:443

98.173.34.212:995

87.202.87.210:2222

Targets

- Target
  
  document-1815464733.xls
- Size
  
  315KB
- MD5
  
  ad8abd960da582994c27d5df3ad28be3
- SHA1
  
  dad5b3918146089d242da674521ec7719f081d6e
- SHA256
  
  ec1cebb04afc604a8a3381ea4d9ad2a77c268e35146740b2eb4565bfa91bb6da
- SHA512
  
  c40e7ae19c15ee9a705ce42a92551ac779170a83fde5298e84d19900cd466f82e294fa157175d218101e02e722676b91271baf2ba935312cf5a9497085bd7d15
Score

10^/10

qakbot tr 1613385567 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

qakbottr1613385567bankerstealertrojan