qakbot | cbe2f650ed2c319130bc060a600c4b9d17d255d319b24fac10da293c673b3572

General

Target

67bdb286d03b8b4760e792b29c5fd6a1.dll
Size

801KB
Sample

210226-dwheaennbn
MD5

67bdb286d03b8b4760e792b29c5fd6a1
SHA1

c722600b1355bbcfa06bd727be9ddc93c2664d8b
SHA256

cbe2f650ed2c319130bc060a600c4b9d17d255d319b24fac10da293c673b3572
SHA512

8a034c67c7d9be3b51930440af939f9b014548d2599535930df18fc81e1bb114cbdadcfc86cf68e6d4ed8818633ced871fe252d0a242b5387d082b185008b4ed

Score

10^/10

Malware Config

Extracted

Family

qakbot

Botnet

biden02

Campaign

1614254614

C2

71.163.223.159:443

83.110.9.71:2222

87.202.87.210:2222

47.22.148.6:443

78.180.179.136:443

67.8.103.21:443

140.82.49.12:443

213.60.147.140:443

187.250.39.162:443

86.236.77.68:2222

108.46.145.30:443

172.87.157.235:3389

79.115.174.55:443

217.133.54.140:32100

83.110.109.106:2222

78.63.226.32:443

83.196.56.65:2222

59.90.246.200:443

89.137.211.239:995

105.96.8.96:443

Targets

- Target
  
  67bdb286d03b8b4760e792b29c5fd6a1.dll
- Size
  
  801KB
- MD5
  
  67bdb286d03b8b4760e792b29c5fd6a1
- SHA1
  
  c722600b1355bbcfa06bd727be9ddc93c2664d8b
- SHA256
  
  cbe2f650ed2c319130bc060a600c4b9d17d255d319b24fac10da293c673b3572
- SHA512
  
  8a034c67c7d9be3b51930440af939f9b014548d2599535930df18fc81e1bb114cbdadcfc86cf68e6d4ed8818633ced871fe252d0a242b5387d082b185008b4ed
Score

10^/10

qakbot biden02 1614254614 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Suspicious use of NtCreateProcessExOtherParentProcess

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2