qakbot | f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f

Sharing

Copy URL Twitter E-mail

General

Target
f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f
Size 867KB
Sample220217-q356escdbq
SHA256 f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f
MD5 b2bfda83034e98d3680be319edd08574
SHA1 05b9372ad48e1477dd3cda3f49e28df2dd7c20f3
SHA512 d15dcd3fd88150323f44bf55133cda90fbfdaa198dd779409b1a76abbb00e7eade34ed41ed3940f5454741d61896e26b2fd1ab8a438fda64c0e23ba4fd78c46d
MD5 SHA1 SHA512

Score

10^/10

qakbot tr 1644947846 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.509

Botnet

Campaign

1644947846

89.101.97.139:443
37.211.176.26:61202
70.51.137.204:2222
72.252.201.34:990
72.252.201.34:995
72.66.116.235:995
173.21.10.71:2222
45.9.20.200:443
75.156.151.34:443
2.50.41.69:61200
31.35.28.29:443
100.1.108.246:443
67.209.195.198:443
89.211.208.234:2222
217.164.115.166:2222
161.142.54.62:443
96.246.158.154:995
190.73.3.148:2222
41.228.22.180:443
108.4.67.252:443
45.46.53.140:2222
190.206.211.182:443
188.55.243.70:995
31.215.206.13:443
89.86.33.217:443
76.25.142.196:443
71.74.12.34:443
180.233.150.134:995
73.151.236.31:443
217.128.122.65:2222
75.188.35.168:443
92.177.45.46:2078
66.230.104.103:443
24.53.49.240:443
78.87.41.5:995
86.97.247.79:1194
41.205.12.24:443
70.45.27.254:443
24.178.196.158:2222
140.82.49.12:443
109.12.111.14:443
86.97.247.79:2222
82.152.39.39:443
209.210.95.228:32100
181.118.183.28:443
149.135.101.20:443
74.15.2.252:2222
136.143.11.232:443
176.67.56.94:443
69.14.172.24:443
78.96.235.245:443
96.21.251.127:2222
217.128.171.34:2222
32.221.231.1:443
120.150.218.241:995
39.44.150.120:995
212.34.15.205:443
114.79.148.170:443
68.204.7.158:443
117.248.109.38:21
111.125.245.116:995
39.49.5.42:995
103.17.101.139:995
103.142.10.177:443
24.222.20.254:443
102.65.38.67:443
139.64.13.189:443
86.98.156.45:993
95.14.104.242:995
182.191.92.203:995
182.176.180.73:443
1.161.88.84:443
128.106.122.39:443
1.161.88.84:995
196.74.174.44:443
89.137.52.44:443
67.69.166.79:2222
83.110.74.44:995
86.98.10.175:995
182.121.70.122:2222
75.67.73.144:443
73.59.201.174:443
86.198.170.170:2222
67.165.206.193:993
96.37.113.36:993
41.230.62.211:993
86.98.49.16:443
38.70.253.226:2222
109.51.132.148:995
76.23.237.163:995
220.255.25.1:2222
82.41.63.217:443
86.97.161.184:443
86.98.156.24:32101
184.100.174.73:443
87.71.18.6:443
218.101.110.3:995
94.60.254.81:443
24.152.219.253:995
101.50.120.112:995
78.101.202.183:443
37.177.81.142:995
103.139.242.30:990
201.172.31.135:80
40.134.247.125:995
197.89.20.13:443
113.28.253.9:995
41.86.42.158:995
5.32.41.46:443
78.164.40.62:995
105.184.195.32:995
217.128.93.27:2222
80.6.192.58:443
136.232.34.70:443
39.52.253.188:995
103.139.242.30:993
75.169.34.158:443
31.215.29.238:443
173.26.188.246:443
41.84.238.71:443
23.82.128.108:443
24.95.61.62:443
144.86.6.161:443
175.137.153.178:443
70.163.1.219:443
31.215.23.29:2222
37.203.225.248:443
193.251.59.245:2222
73.136.32.202:443
86.178.220.77:443
31.215.142.105:2078
73.67.152.98:2222
43.231.252.200:443
41.209.126.246:443
37.186.54.25:995
162.210.220.137:2222
188.50.206.1:995
103.123.225.38:6881
70.50.147.95:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f
- Size 867KB
- SHA256 f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f
- MD5 b2bfda83034e98d3680be319edd08574
- SHA1 05b9372ad48e1477dd3cda3f49e28df2dd7c20f3
- SHA512 d15dcd3fd88150323f44bf55133cda90fbfdaa198dd779409b1a76abbb00e7eade34ed41ed3940f5454741d61896e26b2fd1ab8a438fda64c0e23ba4fd78c46d
- MD5 SHA1 SHA512
Score

10^/10

qakbot tr 1644947846 banker evasion stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Windows security bypass

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2