qakbot | 02caf6e564c885476eded0b0558f70858a418fd8226eab2a9b79317500a471ae

General

Target

fikftkm.thj
Size

1.4MB
Sample

210415-ymzdndn6xx
MD5

f39651904de252f4e96ece7a5f844f8d
SHA1

a4d212ee9cba9ae0a79582182ac4776948349541
SHA256

02caf6e564c885476eded0b0558f70858a418fd8226eab2a9b79317500a471ae
SHA512

6431bfb563ef1050ac58fecaf72def360003b1ec0c31e4e31eefab838ee2b8eef582025cbd20162c6f146ef29313df1dfb2bdb1b5d01bb227b638b6e8d68733e

Score

10^/10

qakbot tr 1618398298 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1618398298

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Targets

- Target
  
  fikftkm.thj
- Size
  
  1.4MB
- MD5
  
  f39651904de252f4e96ece7a5f844f8d
- SHA1
  
  a4d212ee9cba9ae0a79582182ac4776948349541
- SHA256
  
  02caf6e564c885476eded0b0558f70858a418fd8226eab2a9b79317500a471ae
- SHA512
  
  6431bfb563ef1050ac58fecaf72def360003b1ec0c31e4e31eefab838ee2b8eef582025cbd20162c6f146ef29313df1dfb2bdb1b5d01bb227b638b6e8d68733e
Score

10^/10

qakbot tr 1618398298 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2