qakbot | acdb281362397f530300939773350277d2dd828d2d6f96a98445ebf9c3f716a6

General

Target

pt.dll
Size

473KB
Sample

210611-jh4y975e1e
MD5

4141a399ac724c8cd1e52812406ea2f5
SHA1

ce87d1506f096a36fb25fe7c9f196552fdbaa7ee
SHA256

acdb281362397f530300939773350277d2dd828d2d6f96a98445ebf9c3f716a6
SHA512

d474663cae921eec68663f0d143dfe4eccc32f54e5220441a9cd56f71dd87b6b3b980148fc8e27c88ae05cd1d1305e51900dbce5a38ca6d66fba89e86a824255

Score

10^/10

qakbot tr 1623225382 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

tr

Campaign

1623225382

C2

190.85.91.154:443

140.82.49.12:443

105.198.236.101:443

68.186.192.69:443

24.95.61.62:443

90.65.234.26:2222

197.45.110.165:995

96.61.23.88:995

172.78.51.35:443

184.185.103.157:443

71.163.222.223:443

27.223.92.142:995

24.179.77.236:443

97.69.160.4:2222

188.26.91.212:443

75.67.192.125:443

24.152.219.253:995

92.59.35.196:2222

47.22.148.6:443

216.201.162.158:443

Targets

- Target
  
  pt.dll
- Size
  
  473KB
- MD5
  
  4141a399ac724c8cd1e52812406ea2f5
- SHA1
  
  ce87d1506f096a36fb25fe7c9f196552fdbaa7ee
- SHA256
  
  acdb281362397f530300939773350277d2dd828d2d6f96a98445ebf9c3f716a6
- SHA512
  
  d474663cae921eec68663f0d143dfe4eccc32f54e5220441a9cd56f71dd87b6b3b980148fc8e27c88ae05cd1d1305e51900dbce5a38ca6d66fba89e86a824255
Score

10^/10

qakbot tr 1623225382 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2