qakbot | 8d9e1e626352a77264c9ca7396b10eb5e88df4a962da7a2dad6edd97f77d60db | Triage

Sharing

General

Target

8d9e1e626352a77264c9ca7396b10eb5e88df4a962da7a2dad6edd97f77d60db
Size

339KB
Sample

220316-3s15yahcg5
MD5

7bd6946d5d1b2f423cee24901323f9a2
SHA1

794832a6850b6130f34ee20812b1c4fa60b7e691
SHA256

8d9e1e626352a77264c9ca7396b10eb5e88df4a962da7a2dad6edd97f77d60db
SHA512

3f029889cd527dab96e6f2d5fb326a347787ebd4f81fbc0e6767eb4112ebf386f0c7806bcf1fdb5c960b85ccae2c35b548c15b0f7222c764bf420120a5b0849a

Score

10^/10

qakbot abc027 1604574287 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.59

Botnet

abc027

Campaign

1604574287

C2

93.86.252.177:995

184.98.97.227:995

188.25.24.21:2222

1.54.190.204:443

89.137.211.239:443

78.101.234.58:443

41.206.131.166:443

87.27.110.90:2222

47.44.217.98:443

197.45.110.165:995

217.133.54.140:32100

41.97.170.119:443

185.246.9.69:995

90.53.232.130:2222

72.186.1.237:443

144.139.230.139:443

86.164.27.33:2222

185.105.131.233:443

90.146.209.224:2222

108.46.145.30:443

Targets

- Target
  
  8d9e1e626352a77264c9ca7396b10eb5e88df4a962da7a2dad6edd97f77d60db
- Size
  
  339KB
- MD5
  
  7bd6946d5d1b2f423cee24901323f9a2
- SHA1
  
  794832a6850b6130f34ee20812b1c4fa60b7e691
- SHA256
  
  8d9e1e626352a77264c9ca7396b10eb5e88df4a962da7a2dad6edd97f77d60db
- SHA512
  
  3f029889cd527dab96e6f2d5fb326a347787ebd4f81fbc0e6767eb4112ebf386f0c7806bcf1fdb5c960b85ccae2c35b548c15b0f7222c764bf420120a5b0849a
Score

10^/10

qakbot abc027 1604574287 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotabc0271604574287bankerstealertrojan

behavioral2

qakbotabc0271604574287bankerstealertrojan