Overview

overview

10

Static

static

9

ed29a2f69f...85.exe

windows7_x64

10

ed29a2f69f...85.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed29a2f69fce0d137552ba25ae97e99033527c56a9365b5637abce6cc2bce185

  • Size

    2.2MB

  • Sample

    220205-j8xb5shea4

  • MD5

    8df49fd30a7193206bdef9e99c35e6bf

  • SHA1

    67e17fee3d00c0559a8e23a40ebb88f12315a0c7

  • SHA256

    ed29a2f69fce0d137552ba25ae97e99033527c56a9365b5637abce6cc2bce185

  • SHA512

    3b915e8486eb26120bf216e253c984571ed40bae700421ea41a26c557d0d5afd3a83f0491e2f7c52355f37da83a9e7c99e56dfb9789d584f1bd6f8d43fd11c2a

Score
10/10
qakbotspx991587123128bankercryptonepackerpersistencestealertrojan

Malware Config

Extracted

Family

qakbot

Version

324.127

Botnet

spx99

Campaign

1587123128

C2

66.208.105.6:443

83.25.7.201:2222

68.134.181.98:443

108.190.151.108:2222

81.102.127.116:443

93.118.221.204:443

72.183.129.56:443

72.29.181.77:2222

96.35.170.82:2222

50.104.67.101:443

5.182.39.156:443

68.224.192.39:443

50.244.112.106:443

47.205.231.60:443

67.209.195.198:3389

47.146.169.85:443

86.124.13.55:443

108.30.161.143:443

75.87.161.32:995

67.131.59.17:443

Targets

    • Target

      ed29a2f69fce0d137552ba25ae97e99033527c56a9365b5637abce6cc2bce185

    • Size

      2.2MB

    • MD5

      8df49fd30a7193206bdef9e99c35e6bf

    • SHA1

      67e17fee3d00c0559a8e23a40ebb88f12315a0c7

    • SHA256

      ed29a2f69fce0d137552ba25ae97e99033527c56a9365b5637abce6cc2bce185

    • SHA512

      3b915e8486eb26120bf216e253c984571ed40bae700421ea41a26c557d0d5afd3a83f0491e2f7c52355f37da83a9e7c99e56dfb9789d584f1bd6f8d43fd11c2a

    Score
    10/10
    qakbotspx991587123128bankerstealertrojanpersistence

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks