Overview

overview

10

Static

static

9

191465daa9...9c.exe

windows7_x64

10

191465daa9...9c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    191465daa926443b52e0ac1a5364c608c5adc54cdb8bac976e4b5938eeffd39c

  • Size

    1.8MB

  • Sample

    220201-j19x9sbgf3

  • MD5

    11774e0c65f136f9b3f6d5e0c28c819f

  • SHA1

    a6b54e224938721ee7b0f58fc39a951a59688faf

  • SHA256

    191465daa926443b52e0ac1a5364c608c5adc54cdb8bac976e4b5938eeffd39c

  • SHA512

    7a4abb9cc4348ecce56d1feb4c75341ecb80c2cd8b8281543e68dc734b5980a66762021dc4fe57504dec0cac0b1f30907df8352c8999c0751708b6d6fe8e0507

Score
10/10
qakbotspx851585211304bankercryptonepackerpersistencestealertrojan

Malware Config

Extracted

Family

qakbot

Version

324.70

Botnet

spx85

Campaign

1585211304

C2

174.82.131.155:995

173.172.205.216:443

71.233.73.222:995

208.126.142.17:443

68.14.210.246:22

96.57.237.162:443

74.138.18.247:443

47.40.244.237:443

71.213.61.215:995

216.201.162.158:443

72.38.44.119:995

47.41.3.57:443

67.250.184.157:443

47.153.115.154:443

173.79.220.156:443

108.27.217.44:443

75.81.25.223:995

67.209.195.198:3389

65.30.12.240:443

66.222.88.126:995

Targets

    • Target

      191465daa926443b52e0ac1a5364c608c5adc54cdb8bac976e4b5938eeffd39c

    • Size

      1.8MB

    • MD5

      11774e0c65f136f9b3f6d5e0c28c819f

    • SHA1

      a6b54e224938721ee7b0f58fc39a951a59688faf

    • SHA256

      191465daa926443b52e0ac1a5364c608c5adc54cdb8bac976e4b5938eeffd39c

    • SHA512

      7a4abb9cc4348ecce56d1feb4c75341ecb80c2cd8b8281543e68dc734b5980a66762021dc4fe57504dec0cac0b1f30907df8352c8999c0751708b6d6fe8e0507

    Score
    10/10
    qakbotspx851585211304bankerstealertrojanpersistence

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks