qakbot | 937c947fd9c179bfb30ce87ad9e8ca0cc5750f1c05b619df4e2ea3e4c8469082

General

Target

VDscytujyctfjkvu2.ocx
Size

1.6MB
Sample

220124-xv663shca4
MD5

f6a7f2d466ec7999806fd8b5792fbf75
SHA1

c3b20683a679b197ca9ac013e7c163bd3e2367e0
SHA256

937c947fd9c179bfb30ce87ad9e8ca0cc5750f1c05b619df4e2ea3e4c8469082
SHA512

ed62dbd8f14f66cf65ba4e49bafdc8adee2d305a091cd91bdf7153518199da766e8c0116a80b96dec1415f056d184d7d48a312014f8964b45667ba2e62d84382

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama152

Campaign

1643038242

C2

67.209.195.198:443

75.156.151.34:443

89.101.97.139:443

23.229.117.237:443

45.9.20.200:443

70.45.174.173:443

140.82.49.12:443

86.98.47.119:61200

96.246.158.154:995

185.249.85.209:443

89.114.156.182:995

92.99.167.144:2078

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

37.210.172.200:2222

82.152.39.39:443

70.51.153.245:2222

103.143.8.71:6881

39.49.110.129:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  VDscytujyctfjkvu2.ocx
- Size
  
  1.6MB
- MD5
  
  f6a7f2d466ec7999806fd8b5792fbf75
- SHA1
  
  c3b20683a679b197ca9ac013e7c163bd3e2367e0
- SHA256
  
  937c947fd9c179bfb30ce87ad9e8ca0cc5750f1c05b619df4e2ea3e4c8469082
- SHA512
  
  ed62dbd8f14f66cf65ba4e49bafdc8adee2d305a091cd91bdf7153518199da766e8c0116a80b96dec1415f056d184d7d48a312014f8964b45667ba2e62d84382
Score

10^/10

qakbot obama152 1643038242 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2