qakbot | 3b1ea4d5e223f8ca9efe521bae4ec7f126732bfe83ad538cf6a85f06266a0ecc

General

Target

44329.5940229167.dat.dll
Size

646KB
Sample

210513-tyxzkjnys6
MD5

cf9933efd6098e7349faf236a83e993e
SHA1

07b0134da2b9a76a41de5dc4e6a1890ad46f39e9
SHA256

3b1ea4d5e223f8ca9efe521bae4ec7f126732bfe83ad538cf6a85f06266a0ecc
SHA512

ee8692d5cdbf1dc4ad03e63b0981d4f033e5135cccc0f12788d1d3a83de0de20d70390240d20d504b9a40976f25cb7338a7efa803db3045040f8723763cafed3

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

obama41

Campaign

1620911205

C2

71.41.184.10:3389

216.201.162.158:443

95.77.223.148:443

71.74.12.34:443

86.220.62.251:2222

24.229.150.54:995

24.55.112.61:443

76.25.142.196:443

136.232.34.70:443

149.28.99.97:443

45.63.107.192:2222

45.63.107.192:443

149.28.99.97:2222

149.28.99.97:995

45.63.107.192:995

86.248.16.253:2222

86.160.137.225:443

75.67.192.125:443

140.82.49.12:443

47.22.148.6:443

Targets

- Target
  
  44329.5940229167.dat.dll
- Size
  
  646KB
- MD5
  
  cf9933efd6098e7349faf236a83e993e
- SHA1
  
  07b0134da2b9a76a41de5dc4e6a1890ad46f39e9
- SHA256
  
  3b1ea4d5e223f8ca9efe521bae4ec7f126732bfe83ad538cf6a85f06266a0ecc
- SHA512
  
  ee8692d5cdbf1dc4ad03e63b0981d4f033e5135cccc0f12788d1d3a83de0de20d70390240d20d504b9a40976f25cb7338a7efa803db3045040f8723763cafed3
Score

10^/10

qakbot obama41 1620911205 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2