Overview

overview

10

Static

static

8

document-1...71.xls

windows7_x64

10

document-1...71.xls

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    document-1406506371.xls
  • Size 88KB
  • Sample210218-gfx29gmlk2
  • SHA256 ed89c55ffb07c4e94576eada0c0a91d86988772535844fdd8d784702934c66f3
  • MD5 SHA1 SHA512
Score
10/10
qakbottr1613385567bankermacrostealertrojanxlm

Malware Config

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    https://lloydsindian.co.uk/ds/1802.gif

Extracted

Family

  • qakbot

Botnet

  • tr

Campaign

  • 1613385567

C2

  • 78.63.226.32:443

  • 197.51.82.72:443

  • 193.248.221.184:2222

  • 95.77.223.148:443

  • 71.199.192.62:443

  • 77.211.30.202:995

  • 80.227.5.69:443

  • 77.27.204.204:995

  • 81.97.154.100:443

  • 173.184.119.153:995

  • 38.92.225.121:443

  • 81.150.181.168:2222

  • 90.65.236.181:2222

  • 83.110.103.152:443

  • 73.153.211.227:443

  • 188.25.63.105:443

  • 89.137.211.239:995

  • 202.188.138.162:443

  • 98.173.34.212:995

  • 87.202.87.210:2222

Targets

    • Target
      document-1406506371.xls
    • Size 88KB
    • SHA256 ed89c55ffb07c4e94576eada0c0a91d86988772535844fdd8d784702934c66f3
    • MD5 SHA1 SHA512
    Score
    10/10
    qakbottr1613385567bankerstealertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks