qakbot | 606a729b3e06378da218380ffa7365eac8861968ce86149a07dd76e51b89e2ab

General

Target

443005396033565.dat.dll
Size

692KB
Sample

210423-h4en3nlg9x
MD5

f883ce357ee0e792a340cc75950239ae
SHA1

bd843bccc175abb2d20f7560d59fb518b997a293
SHA256

606a729b3e06378da218380ffa7365eac8861968ce86149a07dd76e51b89e2ab
SHA512

627bc272b4d39fe4b135673608b0de94fd7a40c246513e6b69b600bd2ae2f80f011a9a429e439a2919f542aa96e557c0b00edfa6622957ce320f1f4df982dea1

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

clinton09

Campaign

1619121510

C2

197.45.110.165:995

105.198.236.101:443

190.85.91.154:443

71.163.222.243:443

45.63.107.192:995

149.28.99.97:2222

109.12.111.14:443

75.67.192.125:443

24.139.72.117:443

75.118.1.141:443

105.198.236.99:443

173.21.10.71:2222

136.232.34.70:443

140.82.49.12:443

98.192.185.86:443

71.41.184.10:3389

73.25.124.140:2222

83.196.56.65:2222

24.152.219.253:995

189.210.115.207:443

Targets

- Target
  
  443005396033565.dat.dll
- Size
  
  692KB
- MD5
  
  f883ce357ee0e792a340cc75950239ae
- SHA1
  
  bd843bccc175abb2d20f7560d59fb518b997a293
- SHA256
  
  606a729b3e06378da218380ffa7365eac8861968ce86149a07dd76e51b89e2ab
- SHA512
  
  627bc272b4d39fe4b135673608b0de94fd7a40c246513e6b69b600bd2ae2f80f011a9a429e439a2919f542aa96e557c0b00edfa6622957ce320f1f4df982dea1
Score

10^/10

qakbot clinton09 1619121510 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2