Overview

overview

10

Static

static

0378a6ada7...95.exe

windows7_x64

10

0378a6ada7...95.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0378a6ada75fab18adae2c92b9721abb7a122c36101d7e0d695974a496d72f95
  • Size 993KB
  • Sample220508-b812bscag6
  • SHA256 0378a6ada75fab18adae2c92b9721abb7a122c36101d7e0d695974a496d72f95
  • MD5 SHA1 SHA512
Score
10/10
qakbotabc0131601889478bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 325.43

Botnet

  • abc013

Campaign

  • 1601889478

C2

  • 199.116.241.147:443

  • 71.187.170.235:443

  • 71.126.139.251:443

  • 2.50.159.48:2222

  • 31.5.168.31:443

  • 190.85.91.154:443

  • 173.245.152.231:443

  • 39.36.218.78:995

  • 78.96.199.79:443

  • 172.78.30.215:443

  • 61.230.5.67:443

  • 197.133.117.15:443

  • 24.213.191.38:0

  • 184.97.132.62:443

  • 96.227.127.13:443

  • 24.218.181.15:443

  • 96.30.198.161:443

  • 77.27.174.49:995

  • 45.77.193.83:443

  • 207.246.75.201:443

Targets

    • Target
      0378a6ada75fab18adae2c92b9721abb7a122c36101d7e0d695974a496d72f95
    • Size 993KB
    • SHA256 0378a6ada75fab18adae2c92b9721abb7a122c36101d7e0d695974a496d72f95
    • MD5 SHA1 SHA512
    Score
    10/10
    qakbotabc0131601889478bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks