qakbot | 3b4d7f8036918c75267ca13980ac17419652c12d968336013808b04151b47455

General

Target

de9aac78d73718b4cb88e046cfdd8113
Size

893KB
Sample

210616-2e3jedrzgx
MD5

de9aac78d73718b4cb88e046cfdd8113
SHA1

fddc61687e4a8e94a6ca9581979ece4aa7c08f08
SHA256

3b4d7f8036918c75267ca13980ac17419652c12d968336013808b04151b47455
SHA512

5abfb50760a0f5c180c50e185df70ecfafc00fb4ce300959f2e048897409a83f76a60f63f1c7250ef550a720cb9881600bec7da79e03b78c4316d10bbbfca3eb

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

obama60

Campaign

1623839235

C2

71.163.222.223:443

83.110.109.155:2222

140.82.49.12:443

144.139.47.206:443

105.198.236.101:443

136.232.34.70:443

90.65.234.26:2222

71.41.184.10:3389

98.192.185.86:443

184.185.103.157:443

24.179.77.236:443

81.97.154.100:443

186.144.33.73:443

96.253.46.210:443

213.122.113.120:443

47.22.148.6:443

149.28.99.97:995

45.63.107.192:2222

45.32.211.207:443

45.32.211.207:8443

Targets

- Target
  
  de9aac78d73718b4cb88e046cfdd8113
- Size
  
  893KB
- MD5
  
  de9aac78d73718b4cb88e046cfdd8113
- SHA1
  
  fddc61687e4a8e94a6ca9581979ece4aa7c08f08
- SHA256
  
  3b4d7f8036918c75267ca13980ac17419652c12d968336013808b04151b47455
- SHA512
  
  5abfb50760a0f5c180c50e185df70ecfafc00fb4ce300959f2e048897409a83f76a60f63f1c7250ef550a720cb9881600bec7da79e03b78c4316d10bbbfca3eb
Score

10^/10

qakbot obama60 1623839235 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2