qakbot | 0a6cf7b738400024cf43520ef5c5e4300bceaab2d661fb23baeb6af3ecf8ba50

General

Target

44476.6730537037.dat
Size

825KB
Sample

211007-wb2xkscga5
MD5

9c79d024ca1aaa2fc623179164e2f241
SHA1

af9fdab4ea6ac26994289dc9edadd86cb7f0aa2b
SHA256

0a6cf7b738400024cf43520ef5c5e4300bceaab2d661fb23baeb6af3ecf8ba50
SHA512

975fdfb8d9bc9329561b0697bebe4839ea5c61db8a6bc61a37be1f10fc5c17f40cdc6b257eef0eb92601067c9e0238e44db60eac33932c9f75f6e4d69df35500

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama111

Campaign

1633590450

C2

37.210.152.224:995

201.93.111.2:995

202.134.178.157:443

89.101.97.139:443

73.52.50.32:443

188.55.235.110:995

27.223.92.142:995

181.118.183.94:443

136.232.34.70:443

186.32.163.199:443

72.173.78.211:443

76.25.142.196:443

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

188.50.169.158:443

174.54.193.186:443

103.148.120.144:443

140.82.49.12:443

Targets

- Target
  
  44476.6730537037.dat
- Size
  
  825KB
- MD5
  
  9c79d024ca1aaa2fc623179164e2f241
- SHA1
  
  af9fdab4ea6ac26994289dc9edadd86cb7f0aa2b
- SHA256
  
  0a6cf7b738400024cf43520ef5c5e4300bceaab2d661fb23baeb6af3ecf8ba50
- SHA512
  
  975fdfb8d9bc9329561b0697bebe4839ea5c61db8a6bc61a37be1f10fc5c17f40cdc6b257eef0eb92601067c9e0238e44db60eac33932c9f75f6e4d69df35500
Score

10^/10

qakbot obama111 1633590450 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2