Overview

overview

10

Static

static

9

6abc19500e...08.exe

windows7_x64

10

6abc19500e...08.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6abc19500e1ffb620bbc0767aecd5de2b51054fe33d708bcb896d6630abc0808

  • Size

    1.9MB

  • Sample

    220226-j1pbkaaad3

  • MD5

    ce2e2a0ff6d0afb352d8f6537aaca63f

  • SHA1

    f95757e33e58bbad7c6ab68628316b106ab3de93

  • SHA256

    6abc19500e1ffb620bbc0767aecd5de2b51054fe33d708bcb896d6630abc0808

  • SHA512

    234043704b40522431e71c26d911c9ad82ae7a62511a6afa328b3b030e654ec5d0ccba8f6cfbaaa8666722cf319a5a69bccc97ef49a3c56b3bd738c50647d432

Score
10/10
qakbotspx1091588257690bankercryptonepackerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

324.136

Botnet

spx109

Campaign

1588257690

C2

68.204.164.222:443

47.185.134.79:443

31.5.21.66:443

24.27.82.216:2222

178.193.33.121:2222

96.250.113.218:443

148.75.231.53:443

50.89.14.94:443

50.108.212.180:443

184.57.17.74:443

58.108.188.231:443

47.41.3.40:443

47.39.177.171:2222

47.136.224.60:443

72.29.181.77:2078

94.53.92.42:443

108.227.161.27:995

203.33.139.134:443

72.204.242.138:443

47.180.66.10:443

Targets

    • Target

      6abc19500e1ffb620bbc0767aecd5de2b51054fe33d708bcb896d6630abc0808

    • Size

      1.9MB

    • MD5

      ce2e2a0ff6d0afb352d8f6537aaca63f

    • SHA1

      f95757e33e58bbad7c6ab68628316b106ab3de93

    • SHA256

      6abc19500e1ffb620bbc0767aecd5de2b51054fe33d708bcb896d6630abc0808

    • SHA512

      234043704b40522431e71c26d911c9ad82ae7a62511a6afa328b3b030e654ec5d0ccba8f6cfbaaa8666722cf319a5a69bccc97ef49a3c56b3bd738c50647d432

    Score
    10/10
    qakbotspx1091588257690bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks