qakbot | dca2f08280f0adbbcf786bf20298354e1f2ce861062606e4a791a6041016abfa

General

Target

malware.dat
Size

1.4MB
Sample

210415-hbj2wajffe
MD5

6159861e0df7df2da7cc5b0eb38dff01
SHA1

5961d12507be0ba3e085af18fa044ae113761c96
SHA256

dca2f08280f0adbbcf786bf20298354e1f2ce861062606e4a791a6041016abfa
SHA512

6af8010ecdb72ff5247cd86bdaf16c683b3f29f820be752770a7ea9e21c1b56fb3b897c6b6d37d8c1adf90dcaa1b5af8d8c8a579ddf3fd1a9de0e27c89c1357d

Score

10^/10

Malware Config

Extracted

Family

qakbot

Botnet

biden29

Campaign

1618496316

C2

45.63.107.192:995

149.28.99.97:2222

75.118.1.141:443

189.210.115.207:443

72.240.200.181:2222

75.137.47.174:443

151.205.102.42:443

136.232.34.70:443

216.201.162.158:443

47.196.192.184:443

67.8.103.21:443

140.82.49.12:443

24.226.156.153:443

71.41.184.10:3389

24.139.72.117:443

71.74.12.34:443

24.55.112.61:443

173.21.10.71:2222

193.248.221.184:2222

105.198.236.99:443

Targets

- Target
  
  malware.dat
- Size
  
  1.4MB
- MD5
  
  6159861e0df7df2da7cc5b0eb38dff01
- SHA1
  
  5961d12507be0ba3e085af18fa044ae113761c96
- SHA256
  
  dca2f08280f0adbbcf786bf20298354e1f2ce861062606e4a791a6041016abfa
- SHA512
  
  6af8010ecdb72ff5247cd86bdaf16c683b3f29f820be752770a7ea9e21c1b56fb3b897c6b6d37d8c1adf90dcaa1b5af8d8c8a579ddf3fd1a9de0e27c89c1357d
Score

10^/10

qakbot biden29 1618496316 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2