qakbot | 224c62bcaf9e4eb208ea49c9727edc7cadfbd58c6209595a66a636627f43d085

General

Target

61a9cd051ab9488ac32b867204301593
Size

893KB
Sample

210616-6mqcynq6kn
MD5

61a9cd051ab9488ac32b867204301593
SHA1

9485475bb304e123f2cf58250ba36ee26706ff26
SHA256

224c62bcaf9e4eb208ea49c9727edc7cadfbd58c6209595a66a636627f43d085
SHA512

8062c1f3af0a92bc8c86e5ad805fe58e4d24cd5a3983d90ddcbc942f04fb3081c383961459496c79b6ca75f939a4b4226565c6b98429d5ccea81831893d3f36c

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

obama60

Campaign

1623839235

C2

71.163.222.223:443

83.110.109.155:2222

140.82.49.12:443

144.139.47.206:443

105.198.236.101:443

136.232.34.70:443

90.65.234.26:2222

71.41.184.10:3389

98.192.185.86:443

184.185.103.157:443

24.179.77.236:443

81.97.154.100:443

186.144.33.73:443

96.253.46.210:443

213.122.113.120:443

47.22.148.6:443

149.28.99.97:995

45.63.107.192:2222

45.32.211.207:443

45.32.211.207:8443

Targets

- Target
  
  61a9cd051ab9488ac32b867204301593
- Size
  
  893KB
- MD5
  
  61a9cd051ab9488ac32b867204301593
- SHA1
  
  9485475bb304e123f2cf58250ba36ee26706ff26
- SHA256
  
  224c62bcaf9e4eb208ea49c9727edc7cadfbd58c6209595a66a636627f43d085
- SHA512
  
  8062c1f3af0a92bc8c86e5ad805fe58e4d24cd5a3983d90ddcbc942f04fb3081c383961459496c79b6ca75f939a4b4226565c6b98429d5ccea81831893d3f36c
Score

10^/10

qakbot obama60 1623839235 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2