qakbot | 51568a69c9d36ac7b322b73429e61fb11e89349088a0fc0c0245f810c8815a67

General

Target

019338921.dll
Size

1.4MB
Sample

220608-lcgmxsaff4
MD5

d715d0ba5bf6142888b13c40b431a8c8
SHA1

5b44fc16e2e8c3a09ac7b8308358dfb676e2a059
SHA256

51568a69c9d36ac7b322b73429e61fb11e89349088a0fc0c0245f810c8815a67
SHA512

5beceb359e954db9b7e9dcdb80e9e8c782f749f9cbf697a28c9fe60b30f517de2f985d87d28b49e2bc08828bc770743d41f00fa784b08b098be35b7e5ccf3a37

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.694

Botnet

obama186

Campaign

1654596660

C2

67.165.206.193:993

63.143.92.99:995

74.14.5.179:2222

182.191.92.203:995

197.89.8.51:443

89.101.97.139:443

86.97.9.190:443

124.40.244.115:2222

80.11.74.81:2222

41.215.153.104:995

179.100.20.32:32101

31.35.28.29:443

202.134.152.2:2222

109.12.111.14:443

93.48.80.198:995

120.150.218.241:995

41.38.167.179:995

177.94.57.126:32101

173.174.216.62:443

1.161.101.20:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  019338921.dll
- Size
  
  1.4MB
- MD5
  
  d715d0ba5bf6142888b13c40b431a8c8
- SHA1
  
  5b44fc16e2e8c3a09ac7b8308358dfb676e2a059
- SHA256
  
  51568a69c9d36ac7b322b73429e61fb11e89349088a0fc0c0245f810c8815a67
- SHA512
  
  5beceb359e954db9b7e9dcdb80e9e8c782f749f9cbf697a28c9fe60b30f517de2f985d87d28b49e2bc08828bc770743d41f00fa784b08b098be35b7e5ccf3a37
Score

10^/10

qakbot obama186 1654596660 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2