qakbot | 3d49f30ed4cef3d532cbc73d99560d7c81db4928e8e2e81d2c83ef09196f17c1

Resubmissions

14/01/2025, 14:37

250114-ry87yszrey10

01/12/2021, 16:04

211201-thx6vsgfe710

Sharing

Copy URL Twitter E-mail

General

Target
Volet2.ocx
Size 807KB
Sample211201-thx6vsgfe7
SHA256 3d49f30ed4cef3d532cbc73d99560d7c81db4928e8e2e81d2c83ef09196f17c1
MD5 70ea022ce20cc54eca56b4ef9b49fcb4
SHA1 d58e7bcf9c7949b8ddaf9129a9504202094b48a3
SHA512 4ae829fc2976bade3f3f49144cf7d19d547c3a9936b32fcb4178cd557595d1b7dc9127c878c4502871b272dd6a75335d387accad73115c7a132c10c81143553a
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama139

Campaign

1638350683

190.73.3.148:2222
39.49.13.81:995
105.198.236.99:995
136.143.11.232:443
2.222.167.138:443
197.89.11.160:443
117.248.109.38:21
174.20.72.123:443
140.82.49.12:443
78.180.170.159:995
103.142.10.177:443
120.150.218.241:995
91.178.126.51:995
81.250.153.227:2222
194.36.28.26:443
89.101.97.139:443
117.198.158.34:443
189.252.184.31:32101
38.70.253.226:2222
93.48.80.198:995
71.74.12.34:443
207.246.112.221:443
216.238.71.31:443
207.246.112.221:995
186.64.67.31:443
136.232.34.70:443
218.101.110.3:995
76.25.142.196:443
102.65.38.57:443
173.21.10.71:2222
94.60.254.81:443
45.46.53.140:2222
189.135.34.124:443
73.151.236.31:443
67.165.206.193:993
200.114.247.160:465
68.204.7.158:443
189.147.174.121:443
100.1.119.41:443
189.152.1.74:80
50.194.160.233:32100
174.206.64.101:443
50.194.160.233:443
24.229.150.54:995
109.12.111.14:443
217.17.56.163:2222
24.55.112.61:443
24.139.72.117:443
182.181.86.190:995
75.169.58.229:32100
129.208.154.145:995
217.165.237.42:443
89.137.52.44:443
73.25.109.183:2222
185.53.147.51:443
103.116.178.85:993
86.8.177.143:443
86.97.10.14:443
27.5.4.111:2222
80.6.192.58:443
101.50.103.248:995
65.100.174.110:8443
94.200.181.154:995
65.100.174.110:995
63.143.92.99:995
75.188.35.168:995
182.176.180.73:443
75.66.88.33:443
189.219.48.188:443
94.203.203.3:995
86.120.85.147:443
123.252.190.14:443
103.150.40.76:995
41.228.22.180:443
111.250.17.237:443
73.140.38.124:443
176.63.117.1:22
111.91.87.187:443
220.255.25.187:2222
92.59.35.196:2222
72.252.201.34:465
209.210.95.228:443
68.186.192.69:443
187.121.105.111:995
103.168.241.143:995
103.168.241.143:465
86.190.203.103:443
93.147.212.206:443
5.238.149.217:61202
72.252.201.34:995
24.152.219.253:995
96.37.113.36:993
45.9.20.200:2211
103.116.178.85:61200
93.48.58.123:2222
27.223.92.142:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  Volet2.ocx
- Size 807KB
- SHA256 3d49f30ed4cef3d532cbc73d99560d7c81db4928e8e2e81d2c83ef09196f17c1
- MD5 70ea022ce20cc54eca56b4ef9b49fcb4
- SHA1 d58e7bcf9c7949b8ddaf9129a9504202094b48a3
- SHA512 4ae829fc2976bade3f3f49144cf7d19d547c3a9936b32fcb4178cd557595d1b7dc9127c878c4502871b272dd6a75335d387accad73115c7a132c10c81143553a
- MD5 SHA1 SHA512
Score

10^/10

qakbot obama139 1638350683 banker evasion stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Windows security bypass

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2