qakbot | 655ba1e9f9e562a6ebff5218b9131840bb56aa23a3b17d1a26ddcb58599c86e9

General

Target

VDscytujyctfjkvu1.ocx
Size

1.6MB
Sample

220124-xr7y7shbe8
MD5

82dfbae667569e2bcd05329618476505
SHA1

8ea1c4d13c6908598817b4157f1a669047b0c1f5
SHA256

655ba1e9f9e562a6ebff5218b9131840bb56aa23a3b17d1a26ddcb58599c86e9
SHA512

c75e00e2f1aed34d5286042c01b07dec5d6d8fe1743d6f493f0ab86751cbd89b59d96b94ac86a7a8a0a17d3552c8594b71345976db4e30e0cadec109d0b7d81e

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama152

Campaign

1643038242

C2

67.209.195.198:443

75.156.151.34:443

89.101.97.139:443

23.229.117.237:443

45.9.20.200:443

70.45.174.173:443

140.82.49.12:443

86.98.47.119:61200

96.246.158.154:995

185.249.85.209:443

89.114.156.182:995

92.99.167.144:2078

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

37.210.172.200:2222

82.152.39.39:443

70.51.153.245:2222

103.143.8.71:6881

39.49.110.129:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  VDscytujyctfjkvu1.ocx
- Size
  
  1.6MB
- MD5
  
  82dfbae667569e2bcd05329618476505
- SHA1
  
  8ea1c4d13c6908598817b4157f1a669047b0c1f5
- SHA256
  
  655ba1e9f9e562a6ebff5218b9131840bb56aa23a3b17d1a26ddcb58599c86e9
- SHA512
  
  c75e00e2f1aed34d5286042c01b07dec5d6d8fe1743d6f493f0ab86751cbd89b59d96b94ac86a7a8a0a17d3552c8594b71345976db4e30e0cadec109d0b7d81e
Score

10^/10

qakbot obama152 1643038242 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2