qakbot | 01f52b6c529cbe6422c8245602cde85039e08ea88fc6bd8aab164cfe673e6ee1 | Triage

Sharing

General

Target

01f52b6c529cbe6422c8245602cde85039e08ea88fc6bd8aab164cfe673e6ee1
Size

339KB
Sample

220316-zmg84aeedm
MD5

b7ebf23e77f7eeea4a4f8b9631692d07
SHA1

e4023b3baca9100dccd1ee4f171284480a49945f
SHA256

01f52b6c529cbe6422c8245602cde85039e08ea88fc6bd8aab164cfe673e6ee1
SHA512

cc58c71046b28aa368f662ebcced4201e3a722fc9a2483e722612e300db2669186d38c42247df6a70d52c10e0f71c7a78b0f67dbf3b92e735979dc3fb22af668

Score

10^/10

qakbot abc027 1604574287 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.59

Botnet

abc027

Campaign

1604574287

C2

93.86.252.177:995

184.98.97.227:995

188.25.24.21:2222

1.54.190.204:443

89.137.211.239:443

78.101.234.58:443

41.206.131.166:443

87.27.110.90:2222

47.44.217.98:443

197.45.110.165:995

217.133.54.140:32100

41.97.170.119:443

185.246.9.69:995

90.53.232.130:2222

72.186.1.237:443

144.139.230.139:443

86.164.27.33:2222

185.105.131.233:443

90.146.209.224:2222

108.46.145.30:443

Targets

- Target
  
  01f52b6c529cbe6422c8245602cde85039e08ea88fc6bd8aab164cfe673e6ee1
- Size
  
  339KB
- MD5
  
  b7ebf23e77f7eeea4a4f8b9631692d07
- SHA1
  
  e4023b3baca9100dccd1ee4f171284480a49945f
- SHA256
  
  01f52b6c529cbe6422c8245602cde85039e08ea88fc6bd8aab164cfe673e6ee1
- SHA512
  
  cc58c71046b28aa368f662ebcced4201e3a722fc9a2483e722612e300db2669186d38c42247df6a70d52c10e0f71c7a78b0f67dbf3b92e735979dc3fb22af668
Score

10^/10

qakbot abc027 1604574287 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotabc0271604574287bankerstealertrojan

behavioral2

qakbotabc0271604574287bankerstealertrojan