Overview

overview

10

Static

static

QBot_72ddb...89.dll

windows7_x64

10

QBot_72ddb...89.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QBot_72ddba9f2e38033f7213ef712c00299202a0ccbf2f9528a8ed7e6dcf17bc1c89.zip

  • Size

    375KB

  • Sample

    220628-r97hhaabgn

  • MD5

    ca9b097e3e100a44862aefc0cb79f2d0

  • SHA1

    2436767c9f1fdeced2c39063508b31c3d689786b

  • SHA256

    889c59b87eb4c678579aa4fe5347ba46daa535d73d0f761da556684d45b81b4c

  • SHA512

    3fc33f60aee5169f153e1a7acfebfd68b84eeb27e3d37f190c917e35613e07c8e5a9a4cf339ce40ae379dcc065582b70475a343d579348629bff8dce0fa6b76b

Score
10/10
qakbottr1643025272bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      QBot_72ddba9f2e38033f7213ef712c00299202a0ccbf2f9528a8ed7e6dcf17bc1c89.bin

    • Size

      525KB

    • MD5

      4fa62000d946c60e9027fe23d8d71aad

    • SHA1

      fb4f02f3f606306a91ecc05fed4ead6097218af9

    • SHA256

      72ddba9f2e38033f7213ef712c00299202a0ccbf2f9528a8ed7e6dcf17bc1c89

    • SHA512

      604b44a58ad0b204b4e619abf7cd6d1f3dffddbbc6acd1851fc4a0d5c5f651b7a115e92ea23ff3e06cdf56f2843a018ddb8713bbdc756e1a986b9e28df2b8918

    Score
    10/10
    qakbottr1643025272bankerstealertrojanevasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks