qakbot | cd01da89e49d5693580142726dc1702bece482b2624f656f3f5736bb4e6a81cb | Triage

Sharing

General

Target

cd01da89e49d5693580142726dc1702bece482b2624f656f3f5736bb4e6a81cb
Size

339KB
Sample

220315-t167gsbgcn
MD5

337e6bf9587c91e5dde872254d89c3a0
SHA1

970ca8e979b02382683b689a03b5bbc643d6e33e
SHA256

cd01da89e49d5693580142726dc1702bece482b2624f656f3f5736bb4e6a81cb
SHA512

3a1202484134ef3782e49519e213b642955214fd7eee22138d2b499ee19750dabb0c273f0e04e19e2719b8179139ab0eb98c35c5709fb0c682d4a969b59f26f9

Score

10^/10

qakbot abc027 1604574287 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.59

Botnet

abc027

Campaign

1604574287

C2

93.86.252.177:995

184.98.97.227:995

188.25.24.21:2222

1.54.190.204:443

89.137.211.239:443

78.101.234.58:443

41.206.131.166:443

87.27.110.90:2222

47.44.217.98:443

197.45.110.165:995

217.133.54.140:32100

41.97.170.119:443

185.246.9.69:995

90.53.232.130:2222

72.186.1.237:443

144.139.230.139:443

86.164.27.33:2222

185.105.131.233:443

90.146.209.224:2222

108.46.145.30:443

Targets

- Target
  
  cd01da89e49d5693580142726dc1702bece482b2624f656f3f5736bb4e6a81cb
- Size
  
  339KB
- MD5
  
  337e6bf9587c91e5dde872254d89c3a0
- SHA1
  
  970ca8e979b02382683b689a03b5bbc643d6e33e
- SHA256
  
  cd01da89e49d5693580142726dc1702bece482b2624f656f3f5736bb4e6a81cb
- SHA512
  
  3a1202484134ef3782e49519e213b642955214fd7eee22138d2b499ee19750dabb0c273f0e04e19e2719b8179139ab0eb98c35c5709fb0c682d4a969b59f26f9
Score

10^/10

qakbot abc027 1604574287 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotabc0271604574287bankerstealertrojan

behavioral2

qakbotabc0271604574287bankerstealertrojan