Overview

overview

10

Static

static

9

f28664f804...0d.exe

windows7_x64

10

f28664f804...0d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f28664f804293677a47b5b60d7424f14474aabd7944f9ac5a6cc59eb710ea20d

  • Size

    1.9MB

  • Sample

    220205-jythhahch9

  • MD5

    45ff703713a8a47a76d13b2c83b73fcd

  • SHA1

    e0a16b47f0abef00690a813d330feff69a2ad195

  • SHA256

    f28664f804293677a47b5b60d7424f14474aabd7944f9ac5a6cc59eb710ea20d

  • SHA512

    3dd753d7a7884165d41772f36f706d1df2c398b83cf3c8642b694e489ebef2f368d9bad1c330e67805da50783b5d49f4f2b9550b9b62744904112710b25d110e

Score
10/10
qakbotspx1091588257690bankercryptonepackerpersistencestealertrojan

Malware Config

Extracted

Family

qakbot

Version

324.136

Botnet

spx109

Campaign

1588257690

C2

68.204.164.222:443

47.185.134.79:443

31.5.21.66:443

24.27.82.216:2222

178.193.33.121:2222

96.250.113.218:443

148.75.231.53:443

50.89.14.94:443

50.108.212.180:443

184.57.17.74:443

58.108.188.231:443

47.41.3.40:443

47.39.177.171:2222

47.136.224.60:443

72.29.181.77:2078

94.53.92.42:443

108.227.161.27:995

203.33.139.134:443

72.204.242.138:443

47.180.66.10:443

Targets

    • Target

      f28664f804293677a47b5b60d7424f14474aabd7944f9ac5a6cc59eb710ea20d

    • Size

      1.9MB

    • MD5

      45ff703713a8a47a76d13b2c83b73fcd

    • SHA1

      e0a16b47f0abef00690a813d330feff69a2ad195

    • SHA256

      f28664f804293677a47b5b60d7424f14474aabd7944f9ac5a6cc59eb710ea20d

    • SHA512

      3dd753d7a7884165d41772f36f706d1df2c398b83cf3c8642b694e489ebef2f368d9bad1c330e67805da50783b5d49f4f2b9550b9b62744904112710b25d110e

    Score
    10/10
    qakbotspx1091588257690bankerstealertrojanpersistence

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks