General

  • Target

    fb655ba69cee58329fa81415b5437a65951770b828dc429c2ee8eace7469f757

  • Size

    2.2MB

  • Sample

    220205-jg1kgshbe3

  • MD5

    8920292ed32a4b94297a9de99a835b49

  • SHA1

    8365005a6e2e7f92ba59ddfd1a114f285e03d4df

  • SHA256

    fb655ba69cee58329fa81415b5437a65951770b828dc429c2ee8eace7469f757

  • SHA512

    6fb5744eba9d396933e65005cb41aa3a6cae7aee89b58a289157d60d0b84fed62e2e34676f6ecd63135adde657b2cdc00b81380b1a76467334b14d49d1686980

Malware Config

Extracted

Family

qakbot

Version

324.127

Botnet

spx95

Campaign

1586782660

C2

47.153.115.154:443

108.27.217.44:443

71.77.252.14:2222

64.19.74.29:995

186.135.93.204:443

96.236.225.10:443

24.37.178.158:443

68.59.27.48:443

76.170.77.99:443

206.183.190.53:995

47.136.224.60:443

68.174.15.223:443

108.188.46.240:995

72.29.181.77:2078

50.29.181.193:995

69.92.54.95:995

47.180.66.10:443

86.125.138.141:995

184.180.157.203:2222

78.96.148.177:443

Targets

    • Target

      fb655ba69cee58329fa81415b5437a65951770b828dc429c2ee8eace7469f757

    • Size

      2.2MB

    • MD5

      8920292ed32a4b94297a9de99a835b49

    • SHA1

      8365005a6e2e7f92ba59ddfd1a114f285e03d4df

    • SHA256

      fb655ba69cee58329fa81415b5437a65951770b828dc429c2ee8eace7469f757

    • SHA512

      6fb5744eba9d396933e65005cb41aa3a6cae7aee89b58a289157d60d0b84fed62e2e34676f6ecd63135adde657b2cdc00b81380b1a76467334b14d49d1686980

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks