qakbot | 661023d940245094bff7e26221ae7e62ac43a1fc6c0d2b81b9bb18d0ad2f92f4 | Triage

Sharing

General

Target

661023d940245094bff7e26221ae7e62ac43a1fc6c0d2b81b9bb18d0ad2f92f4
Size

1.1MB
Sample

220417-rsv35sagc2
MD5

5d54b21dad4c45b968943459ed459d58
SHA1

d028dcf3be25388c62766451b8a138a64c258b3c
SHA256

661023d940245094bff7e26221ae7e62ac43a1fc6c0d2b81b9bb18d0ad2f92f4
SHA512

df436a4d00de6877b5440323d8b811ec812690e67f079eeac9834d4eca68234835d05acd05b6a777c797fc16bfdfc4dcacb823e02356bc9f0f38f31d17646de5

Score

10^/10

qakbot abc023 1603362336 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc023

Campaign

1603362336

C2

207.246.75.201:443

93.86.1.140:995

78.96.199.79:443

185.246.9.69:995

80.14.209.42:2222

72.186.1.237:443

92.59.35.196:2222

45.32.154.10:443

74.129.26.119:443

186.6.196.12:443

5.13.69.214:443

80.240.26.178:443

203.198.96.200:443

108.31.15.10:995

86.98.89.139:2222

156.213.186.133:443

72.36.59.46:2222

5.193.181.221:2078

59.99.39.32:443

108.46.145.30:443

Targets

- Target
  
  661023d940245094bff7e26221ae7e62ac43a1fc6c0d2b81b9bb18d0ad2f92f4
- Size
  
  1.1MB
- MD5
  
  5d54b21dad4c45b968943459ed459d58
- SHA1
  
  d028dcf3be25388c62766451b8a138a64c258b3c
- SHA256
  
  661023d940245094bff7e26221ae7e62ac43a1fc6c0d2b81b9bb18d0ad2f92f4
- SHA512
  
  df436a4d00de6877b5440323d8b811ec812690e67f079eeac9834d4eca68234835d05acd05b6a777c797fc16bfdfc4dcacb823e02356bc9f0f38f31d17646de5
Score

10^/10

qakbot abc023 1603362336 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotabc0231603362336bankerstealertrojan

behavioral2

qakbotabc0231603362336bankerstealertrojan