Overview

overview

10

Static

static

9

d34ccf784c...89.exe

windows7_x64

10

d34ccf784c...89.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d34ccf784cc71fd5e406e3a05531556c6073a67f51a6ffb3ae031774d05fe689

  • Size

    1.9MB

  • Sample

    220226-g7thraback

  • MD5

    21721ea0670ee442362b0bfa6fc5d444

  • SHA1

    f541f5c2e1523ec63c99b1264c02edeb62ed7241

  • SHA256

    d34ccf784cc71fd5e406e3a05531556c6073a67f51a6ffb3ae031774d05fe689

  • SHA512

    f2305b8b4d071b40b079d28e7f7b2c850442975eb26f28db1712e0bb800dd27a05d68e6da860484be0fdeed932960be8556ed9ce1100bc63171010fc4abb3321

Score
10/10
qakbotspx1091588257690bankercryptonepackerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

324.136

Botnet

spx109

Campaign

1588257690

C2

68.204.164.222:443

47.185.134.79:443

31.5.21.66:443

24.27.82.216:2222

178.193.33.121:2222

96.250.113.218:443

148.75.231.53:443

50.89.14.94:443

50.108.212.180:443

184.57.17.74:443

58.108.188.231:443

47.41.3.40:443

47.39.177.171:2222

47.136.224.60:443

72.29.181.77:2078

94.53.92.42:443

108.227.161.27:995

203.33.139.134:443

72.204.242.138:443

47.180.66.10:443

Targets

    • Target

      d34ccf784cc71fd5e406e3a05531556c6073a67f51a6ffb3ae031774d05fe689

    • Size

      1.9MB

    • MD5

      21721ea0670ee442362b0bfa6fc5d444

    • SHA1

      f541f5c2e1523ec63c99b1264c02edeb62ed7241

    • SHA256

      d34ccf784cc71fd5e406e3a05531556c6073a67f51a6ffb3ae031774d05fe689

    • SHA512

      f2305b8b4d071b40b079d28e7f7b2c850442975eb26f28db1712e0bb800dd27a05d68e6da860484be0fdeed932960be8556ed9ce1100bc63171010fc4abb3321

    Score
    10/10
    qakbotspx1091588257690bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks