Overview

overview

10

Static

static

QBot/102755.dll

windows10_x64

10

QBot/TXRTN...70.lnk

windows10_x64

3

QBot/Windo...cs.dll

windows10_x64

1

QBot/calc.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QBot.zip

  • Size

    680KB

  • Sample

    220712-qe5vrabehm

  • MD5

    77243c24ee0df10a34279e8cbd48879e

  • SHA1

    5d6de5d889e1bd53f46df41ef6f89f9d1cc184db

  • SHA256

    2db6ed1bbdd48e296d82f7ebf9b54524bd79d5a97b0b7b08c9d093cd57e54060

  • SHA512

    ee1fd34b98587e96bb20f43585a3e9af56bfbcfa584ee0797f19da0835d235ee6e75013fed65ac85885968c18d7898180bc884ccbd32f3ce94af2e1bf342d8b5

Score
10/10
qakbotobama2001657548298bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama200

Campaign

1657548298

C2

172.115.177.204:2222

89.101.97.139:443

186.90.153.162:2222

38.70.253.226:2222

120.150.218.241:995

72.252.157.93:995

72.252.157.93:993

94.36.193.176:2222

47.23.89.60:993

89.211.209.234:2222

76.25.142.196:443

46.100.25.239:61202

24.158.23.166:995

69.14.172.24:443

92.132.132.81:2222

37.34.253.233:443

93.48.80.198:995

174.80.15.101:2083

24.178.196.158:2222

197.89.20.137:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      QBot/102755.dll

    • Size

      686KB

    • MD5

      eadf90733e12275a34e5f63548c79837

    • SHA1

      dd267a5237bf39afc4cccaaa34d6869be22f3ec8

    • SHA256

      019990dfdd8cc4aa751ba4ee0ffefc7f10fdd899ef2a75ef250c8b8f1b46a34d

    • SHA512

      7cdeb363e83b9a82c7f9bad3f67ace3864a28b46d9219e4b2dd09ce864360c48d9222317932100b882b63db29d3ec094b4d2b0d5865e5a26d32cb6f9e97bfc8a

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan
    behavioral1

    • Target

      QBot/TXRTN_4890370.lnk

    • Size

      1KB

    • MD5

      eea824215afd2936b4b9c428558a11ed

    • SHA1

      de5d15491319ee9c15c3bcbf215d9f6996f76776

    • SHA256

      aa1add7b438592b57f9c7e53f5c19ead55d313824822835c73ca998f8e06134d

    • SHA512

      24b0322fefbbb9eb57629f9396466cfbc79e205f126209319cd9ad2c83dda9a7975ac987058dc730e9149b6e315cfed35924e40a14a313655961bb4ed26a0b77

    Score
    3/10
    behavioral2

    • Target

      QBot/WindowsCodecs.dll

    • Size

      4KB

    • MD5

      491e9489c9e11f8b9d3d77239559a194

    • SHA1

      f5df8d4edfdc22646c106259c21abe8d79195e31

    • SHA256

      6e3661049bde832369781afa1d9034315442b1e4b87aa92d571cbe73186997c5

    • SHA512

      ef0bd113fe6b64d7673b33cce559bdc0cfc99c81baac78c4a15b00b7eeb07470aa36e0f29a695b615fe149858a23733015c467948d889ffbee9a1fc916e2ceae

    Score
    1/10
    behavioral3

    • Target

      QBot/calc.exe

    • Size

      758KB

    • MD5

      60b7c0fead45f2066e5b805a91f4f0fc

    • SHA1

      9018a7d6cdbe859a430e8794e73381f77c840be0

    • SHA256

      80c10ee5f21f92f89cbc293a59d2fd4c01c7958aacad15642558db700943fa22

    • SHA512

      68b9f9c00fc64df946684ce81a72a2624f0fc07e07c0c8b3db2fae8c9c0415bd1b4a03ad7ffa96985af0cc5e0410f6c5e29a30200efff21ab4b01369a3c59b58

    Score
    10/10
    qakbotobama2001657548298bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks