qakbot | e55a662e05fdc1e0c8570564bfcdb0d7cbec3bf5eca101ab12ac2997998c2aa9

Resubmissions

14/02/2022, 20:50

220214-zmpceaaed210

14/02/2022, 19:27

220214-x58snaaea210

Sharing

Copy URL Twitter E-mail

General

Target
1621832826316290.ocx
Size 1.0MB
Sample220214-x58snaaea2
SHA256 e55a662e05fdc1e0c8570564bfcdb0d7cbec3bf5eca101ab12ac2997998c2aa9
MD5 f0ed5abd066e73fbb0383ea70d1674d4
SHA1 9a60895c35e0b46c09ed778c697a3b8bae8b9680
SHA512 8f5313a0e593dacc8869d6906c85555b1b740175e66542c82e3827f5697dc61451ddf4a81a59b3c1ee40a24360d5542694afe6af5330b565c9814c8cd61da3ca
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.491

Botnet

obama155

Campaign

1644841339

120.150.218.241:995
32.221.231.1:443
75.67.73.144:443
82.152.39.39:443
41.230.62.211:993
1.161.70.155:443
139.64.13.189:443
31.215.116.182:2222
76.23.237.163:995
39.44.150.120:995
67.209.195.198:443
37.210.157.12:2222
39.49.98.233:995
89.101.97.139:443
45.9.20.200:443
75.156.151.34:443
42.235.144.180:2222
2.50.41.69:61200
31.35.28.29:443
86.98.156.45:993
212.34.15.205:443
103.17.101.139:995
217.164.115.166:2222
96.246.158.154:995
217.128.171.34:2222
190.73.3.148:2222
41.143.153.235:443
41.228.22.180:443
86.98.49.16:443
182.191.92.203:995
220.255.25.1:2222
180.233.150.134:995
129.208.11.149:995
102.65.38.67:443
78.96.235.245:443
24.53.49.240:443
78.87.41.5:995
136.143.11.232:443
140.82.49.12:443
111.125.245.116:995
82.41.63.217:443
24.178.196.158:2222
38.70.253.226:2222
74.15.2.252:2222
92.177.45.46:2078
209.210.95.228:32100
37.211.176.26:61202
149.135.101.20:443
24.222.20.254:443
96.21.251.127:2222
80.14.196.176:2222
176.67.56.94:443
1.161.70.155:995
76.25.142.196:443
86.97.161.184:443
103.142.10.177:443
128.106.122.39:443
86.98.156.82:32101
89.137.52.44:443
86.98.148.144:995
75.188.35.168:443
31.215.185.99:1194
173.21.10.71:2222
71.74.12.34:443
45.46.53.140:2222
73.151.236.31:443
67.165.206.193:993
96.37.113.36:993
95.14.105.51:995
184.100.174.73:443
109.12.111.14:443
217.165.139.33:995
161.142.62.76:443
68.204.7.158:443
87.71.79.81:443
218.101.110.3:995
94.60.254.81:443
114.79.148.170:443
70.51.137.204:2222
31.215.206.13:443
24.152.219.253:995
101.50.120.112:995
69.14.172.24:443
117.248.109.38:21
78.101.202.183:443
37.177.81.142:995
64.231.96.211:2222
103.139.242.30:990
72.252.201.34:990
201.172.31.135:80
100.1.108.246:443
72.252.201.34:995
190.206.211.182:443
40.134.247.125:995
108.4.67.252:443
70.45.27.254:443
197.89.20.13:443
113.28.253.9:995
41.86.42.158:995
5.32.41.46:443
78.164.40.62:995
105.184.195.32:995
217.128.93.27:2222
80.6.192.58:443
136.232.34.70:443
182.176.180.73:443
39.52.239.221:995
103.139.242.30:993
75.169.34.158:443
31.215.29.238:443
89.86.33.217:443
173.26.188.246:443
41.84.238.71:443
23.82.128.108:443
24.95.61.62:443
144.86.6.161:443
113.211.127.95:443
86.198.170.170:2222
70.163.1.219:443
31.215.23.29:2222
37.203.225.248:443
193.251.59.245:2222
73.59.201.174:443
73.136.32.202:443
86.178.220.77:443
31.215.142.105:2078
73.67.152.98:2222
43.231.252.200:443
41.209.126.246:443
37.186.54.25:995
181.118.183.28:443
162.210.220.137:2222
188.50.206.1:995
103.123.225.38:6881
70.50.147.95:2222
72.66.116.235:995
187.191.33.158:443
165.255.54.11:995
31.166.23.80:443
65.100.174.110:8443
65.100.174.110:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  1621832826316290.ocx
- Size 1.0MB
- SHA256 e55a662e05fdc1e0c8570564bfcdb0d7cbec3bf5eca101ab12ac2997998c2aa9
- MD5 f0ed5abd066e73fbb0383ea70d1674d4
- SHA1 9a60895c35e0b46c09ed778c697a3b8bae8b9680
- SHA512 8f5313a0e593dacc8869d6906c85555b1b740175e66542c82e3827f5697dc61451ddf4a81a59b3c1ee40a24360d5542694afe6af5330b565c9814c8cd61da3ca
- MD5 SHA1 SHA512
Score

10^/10

qakbot obama155 1644841339 banker evasion stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Suspicious use of NtCreateProcessExOtherParentProcess
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Suspicious use of NtCreateProcessExOtherParentProcess

Windows security bypass

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2