qakbot | 5f1755aaab8b894f1e249c6cf628a8ab468afa11e4a5f06be4a8c62c4fdf2f8d | Triage

Sharing

General

Target

5f1755aaab8b894f1e249c6cf628a8ab468afa11e4a5f06be4a8c62c4fdf2f8d
Size

339KB
Sample

220414-rq7n6afff9
MD5

3c3141880b2c1974f8944551607da965
SHA1

3ab1d554711c7a7b2a6fb18fa372e4d3c98051d7
SHA256

5f1755aaab8b894f1e249c6cf628a8ab468afa11e4a5f06be4a8c62c4fdf2f8d
SHA512

bbc4d66121b2242314eb21146035cdb9bc29924766aec069bc50f796a343079bd71231944de753f909934fd041c0ae146f99b863247dbb3c30865fd05c4815be

Score

10^/10

qakbot abc027 1604574287 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.59

Botnet

abc027

Campaign

1604574287

C2

93.86.252.177:995

184.98.97.227:995

188.25.24.21:2222

1.54.190.204:443

89.137.211.239:443

78.101.234.58:443

41.206.131.166:443

87.27.110.90:2222

47.44.217.98:443

197.45.110.165:995

217.133.54.140:32100

41.97.170.119:443

185.246.9.69:995

90.53.232.130:2222

72.186.1.237:443

144.139.230.139:443

86.164.27.33:2222

185.105.131.233:443

90.146.209.224:2222

108.46.145.30:443

Targets

- Target
  
  5f1755aaab8b894f1e249c6cf628a8ab468afa11e4a5f06be4a8c62c4fdf2f8d
- Size
  
  339KB
- MD5
  
  3c3141880b2c1974f8944551607da965
- SHA1
  
  3ab1d554711c7a7b2a6fb18fa372e4d3c98051d7
- SHA256
  
  5f1755aaab8b894f1e249c6cf628a8ab468afa11e4a5f06be4a8c62c4fdf2f8d
- SHA512
  
  bbc4d66121b2242314eb21146035cdb9bc29924766aec069bc50f796a343079bd71231944de753f909934fd041c0ae146f99b863247dbb3c30865fd05c4815be
Score

10^/10

qakbot abc027 1604574287 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotabc0271604574287bankerstealertrojan

behavioral2

qakbotabc0271604574287bankerstealertrojan