qakbot | 532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8

Sharing

Copy URL Twitter E-mail

General

Target
532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8
Size 1.1MB
Sample220216-qsdnesdacn
SHA256 532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8
MD5 632cc7523a107db992e19955b2650862
SHA1 70f319f3771aa671fcdb51851af296b4652c5105
SHA512 114f392c3a2c5b03dc0c62ba59a6cb08d83e024d121db917e7ed7a6871733aeb49a5ab4c4e9073579d70ac0273dca41e989b2764acd8b3ebc47d9c6a97e3ed3b
MD5 SHA1 SHA512

Score

10^/10

qakbot tr 1644836475 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.503

Botnet

Campaign

1644836475

220.255.25.1:2222
180.233.150.134:995
129.208.11.149:995
102.65.38.67:443
78.96.235.245:443
24.53.49.240:443
78.87.41.5:995
136.143.11.232:443
140.82.49.12:443
111.125.245.116:995
82.41.63.217:443
24.178.196.158:2222
38.70.253.226:2222
74.15.2.252:2222
92.177.45.46:2078
209.210.95.228:32100
37.211.176.26:61202
149.135.101.20:443
24.222.20.254:443
96.21.251.127:2222
80.14.196.176:2222
176.67.56.94:443
120.150.218.241:995
1.161.70.155:995
32.221.231.1:443
75.67.73.144:443
82.152.39.39:443
1.161.70.155:443
41.230.62.211:993
31.215.116.182:2222
139.64.13.189:443
76.25.142.196:443
75.156.151.34:443
42.235.144.180:2222
2.50.41.69:61200
31.215.99.178:443
39.44.150.120:995
67.209.195.198:443
37.210.157.12:2222
103.142.10.177:443
39.49.98.233:995
89.101.97.139:443
45.9.20.200:443
128.106.122.39:443
86.98.156.45:993
86.98.156.82:32101
212.34.15.205:443
103.17.101.139:995
217.164.115.166:2222
96.246.158.154:995
217.128.171.34:2222
41.143.153.235:443
190.73.3.148:2222
41.228.22.180:443
86.98.49.16:443
182.191.92.203:995
89.137.52.44:443
86.98.148.144:995
75.188.35.168:443
31.215.185.99:1194
173.21.10.71:2222
71.74.12.34:443
45.46.53.140:2222
73.151.236.31:443
67.165.206.193:993
96.37.113.36:993
95.14.105.51:995
76.23.237.163:995
184.100.174.73:443
109.12.111.14:443
217.165.139.33:995
161.142.62.76:443
68.204.7.158:443
87.71.79.81:443
218.101.110.3:995
31.35.28.29:443
94.60.254.81:443
114.79.148.170:443
70.51.137.204:2222
31.215.206.13:443
24.152.219.253:995
101.50.120.112:995
69.14.172.24:443
117.248.109.38:21
78.101.202.183:443
37.177.81.142:995
64.231.96.211:2222
103.139.242.30:990
72.252.201.34:990
201.172.31.135:80
100.1.108.246:443
72.252.201.34:995
190.206.211.182:443
40.134.247.125:995
108.4.67.252:443
70.45.27.254:443
197.89.20.13:443
113.28.253.9:995
41.86.42.158:995
5.32.41.46:443
78.164.40.62:995
105.184.195.32:995
217.128.93.27:2222
80.6.192.58:443
136.232.34.70:443
182.176.180.73:443
39.52.213.0:995
103.139.242.30:993
75.169.34.158:443
31.215.29.238:443
89.86.33.217:443
173.26.188.246:443
41.84.238.71:443
23.82.128.108:443
24.95.61.62:443
144.86.6.161:443
113.211.127.95:443
86.198.170.170:2222
70.163.1.219:443
31.215.23.29:2222
37.203.225.248:443
193.251.59.245:2222
73.59.201.174:443
73.136.32.202:443
86.178.220.77:443
31.215.142.105:2078
73.67.152.98:2222
43.231.252.200:443
41.209.126.246:443
37.186.54.25:995
181.118.183.28:443
162.210.220.137:2222
188.50.206.1:995
103.123.225.38:6881
70.50.147.95:2222
72.66.116.235:995
187.191.33.158:443
165.255.54.11:995
31.166.23.80:443
65.100.174.110:8443
65.100.174.110:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8
- Size 1.1MB
- SHA256 532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8
- MD5 632cc7523a107db992e19955b2650862
- SHA1 70f319f3771aa671fcdb51851af296b4652c5105
- SHA512 114f392c3a2c5b03dc0c62ba59a6cb08d83e024d121db917e7ed7a6871733aeb49a5ab4c4e9073579d70ac0273dca41e989b2764acd8b3ebc47d9c6a97e3ed3b
- MD5 SHA1 SHA512
Score

10^/10

qakbot tr 1644836475 banker evasion stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Windows security bypass

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2