qakbot | 32c2ba5b71174dbc1185851a4912fa0da253aec280b71d19eea74178a9502c2b | Triage

Sharing

General

Target

32c2ba5b71174dbc1185851a4912fa0da253aec280b71d19eea74178a9502c2b
Size

1.1MB
Sample

220417-rtxncsage2
MD5

d38d7b45e909c8a362738654ab5da802
SHA1

2055deb9f7185f7784065d0833c2d37b1264cec0
SHA256

32c2ba5b71174dbc1185851a4912fa0da253aec280b71d19eea74178a9502c2b
SHA512

a82b929e4f7d9666787f0bdd3201ce277e7db0ff035a4ae7019a64095aa28f8850b1503f53a7e715d595b63806e50b76071f220d1f282553291b4b7b1440e4f0

Score

10^/10

qakbot abc023 1603362336 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc023

Campaign

1603362336

C2

207.246.75.201:443

93.86.1.140:995

78.96.199.79:443

185.246.9.69:995

80.14.209.42:2222

72.186.1.237:443

92.59.35.196:2222

45.32.154.10:443

74.129.26.119:443

186.6.196.12:443

5.13.69.214:443

80.240.26.178:443

203.198.96.200:443

108.31.15.10:995

86.98.89.139:2222

156.213.186.133:443

72.36.59.46:2222

5.193.181.221:2078

59.99.39.32:443

108.46.145.30:443

Targets

- Target
  
  32c2ba5b71174dbc1185851a4912fa0da253aec280b71d19eea74178a9502c2b
- Size
  
  1.1MB
- MD5
  
  d38d7b45e909c8a362738654ab5da802
- SHA1
  
  2055deb9f7185f7784065d0833c2d37b1264cec0
- SHA256
  
  32c2ba5b71174dbc1185851a4912fa0da253aec280b71d19eea74178a9502c2b
- SHA512
  
  a82b929e4f7d9666787f0bdd3201ce277e7db0ff035a4ae7019a64095aa28f8850b1503f53a7e715d595b63806e50b76071f220d1f282553291b4b7b1440e4f0
Score

10^/10

qakbot abc023 1603362336 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotabc0231603362336bankerstealertrojan

behavioral2

qakbotabc0231603362336bankerstealertrojan