Overview

overview

10

Static

static

bb6a1a5e16...4b.dll

windows7_x64

10

bb6a1a5e16...4b.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb6a1a5e1655b357107b78519afab7c47ffd32dc914657100849c3aff8d24e4b

  • Size

    2.4MB

  • Sample

    220320-cxhlaafad8

  • MD5

    21dbaa3c867494580125b8c648b5e767

  • SHA1

    8c9921dee58595a377a02c9fe659faf0ff2a5adb

  • SHA256

    bb6a1a5e1655b357107b78519afab7c47ffd32dc914657100849c3aff8d24e4b

  • SHA512

    97fc976716fd96e5ad2aad1105c9a01676114b71d6f01c06866f1b4e728a4f95a8a614f0b6ec91719986348e9fdbf1ffae7546dc6c3f19e5fe0ec965b7c707f0

Score
10/10
qakbotabc1171608719407bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608719407

C2

41.39.134.183:443

113.193.187.2:995

90.188.91.57:995

176.181.247.197:443

78.191.87.198:20

83.110.241.182:443

93.149.167.254:2222

76.111.128.194:443

32.212.117.188:443

72.36.59.46:2222

68.186.192.69:443

94.98.248.152:443

105.226.38.36:443

92.154.83.96:2222

37.210.255.225:995

74.195.52.3:443

73.166.10.38:443

95.77.223.148:443

80.227.5.70:443

91.104.104.63:995

Targets

    • Target

      bb6a1a5e1655b357107b78519afab7c47ffd32dc914657100849c3aff8d24e4b

    • Size

      2.4MB

    • MD5

      21dbaa3c867494580125b8c648b5e767

    • SHA1

      8c9921dee58595a377a02c9fe659faf0ff2a5adb

    • SHA256

      bb6a1a5e1655b357107b78519afab7c47ffd32dc914657100849c3aff8d24e4b

    • SHA512

      97fc976716fd96e5ad2aad1105c9a01676114b71d6f01c06866f1b4e728a4f95a8a614f0b6ec91719986348e9fdbf1ffae7546dc6c3f19e5fe0ec965b7c707f0

    Score
    10/10
    qakbotabc1171608719407bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks