General

  • Target

    f9af24990129bb00953a59c0b56f6426f1a3130f309625fa9a35c89715081772

  • Size

    2.2MB

  • Sample

    220205-jj9aeahdbl

  • MD5

    8628755ea0f5ecc4bcf3cc7c19004dbc

  • SHA1

    1afe38ffc11a53c69069e500ace7cd7429f431d7

  • SHA256

    f9af24990129bb00953a59c0b56f6426f1a3130f309625fa9a35c89715081772

  • SHA512

    148996ba953a8dbe495f0efba09619dea5b8956c1d9533933714287693de86821c0c2b8d9d0d84c57cf20f75be54024bbd248ecbbbe3063a21642c450e323d1c

Malware Config

Extracted

Family

qakbot

Version

324.127

Botnet

spx95

Campaign

1586782660

C2

47.153.115.154:443

108.27.217.44:443

71.77.252.14:2222

64.19.74.29:995

186.135.93.204:443

96.236.225.10:443

24.37.178.158:443

68.59.27.48:443

76.170.77.99:443

206.183.190.53:995

47.136.224.60:443

68.174.15.223:443

108.188.46.240:995

72.29.181.77:2078

50.29.181.193:995

69.92.54.95:995

47.180.66.10:443

86.125.138.141:995

184.180.157.203:2222

78.96.148.177:443

Targets

    • Target

      f9af24990129bb00953a59c0b56f6426f1a3130f309625fa9a35c89715081772

    • Size

      2.2MB

    • MD5

      8628755ea0f5ecc4bcf3cc7c19004dbc

    • SHA1

      1afe38ffc11a53c69069e500ace7cd7429f431d7

    • SHA256

      f9af24990129bb00953a59c0b56f6426f1a3130f309625fa9a35c89715081772

    • SHA512

      148996ba953a8dbe495f0efba09619dea5b8956c1d9533933714287693de86821c0c2b8d9d0d84c57cf20f75be54024bbd248ecbbbe3063a21642c450e323d1c

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks