qakbot | ad42ea143358ea03233ddc36324f810e92d7cf9802eff02dc8c9e50700484212

General

Target

ad42ea143358ea03233ddc36324f810e92d7cf9802eff02dc8c9e50700484212
Size

187KB
Sample

220214-spr3rabbap
MD5

1cc8ff8095bb4c5bf26f33ad37d9b890
SHA1

0d9fd66996885b3176f50d76e7ec6c2b6f5908ae
SHA256

ad42ea143358ea03233ddc36324f810e92d7cf9802eff02dc8c9e50700484212
SHA512

7f2348d70d05c68415f9bffd48461d66c3ff934156b7e257ef4c17eb06bcadec3e8cafe0bf2b5bbe2f89955f8b1c156dd9e66dbeb193013e54fc83ac30275c36

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

324.127

Botnet

spx98

Campaign

1587042061

C2

24.37.178.158:990

24.110.96.149:443

68.1.171.93:443

24.210.45.215:443

77.159.149.74:443

72.190.101.70:443

71.187.170.235:443

24.110.14.40:443

46.102.52.24:443

96.234.20.230:443

184.57.17.74:443

47.153.115.154:993

72.142.106.198:995

12.5.37.3:443

168.103.52.51:995

216.163.4.91:443

100.4.185.8:443

72.172.49.164:443

5.2.149.216:443

47.202.98.230:443

Targets

- Target
  
  ad42ea143358ea03233ddc36324f810e92d7cf9802eff02dc8c9e50700484212
- Size
  
  187KB
- MD5
  
  1cc8ff8095bb4c5bf26f33ad37d9b890
- SHA1
  
  0d9fd66996885b3176f50d76e7ec6c2b6f5908ae
- SHA256
  
  ad42ea143358ea03233ddc36324f810e92d7cf9802eff02dc8c9e50700484212
- SHA512
  
  7f2348d70d05c68415f9bffd48461d66c3ff934156b7e257ef4c17eb06bcadec3e8cafe0bf2b5bbe2f89955f8b1c156dd9e66dbeb193013e54fc83ac30275c36
Score

10^/10

qakbot spx98 1587042061 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2