Overview

overview

10

Static

static

b558197d82...3c.exe

windows7-x64

10

b558197d82...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b558197d8287ef724b6e7af39116450dd2e7bfcfd2b02f6f637fb9f8979aa83c

  • Size

    1.9MB

  • Sample

    220731-e9fnkahfdn

  • MD5

    fe0dfda0d0a36461e119e26f933fdc2a

  • SHA1

    a0214a28a7436eeb7df73f8a76657d33cc78fd34

  • SHA256

    b558197d8287ef724b6e7af39116450dd2e7bfcfd2b02f6f637fb9f8979aa83c

  • SHA512

    531a5cc0df24666f21d36fbd3bbc9916c5f202cf16707aaea5bcc15302ce1ede564173ce2b657c8a089c00e7f2b27290a5a18928b28728b4ad684656fed14efc

Score
10/10
qakbotspx241571222456bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

323.91

Botnet

spx24

Campaign

1571222456

C2

207.179.194.91:443

47.214.144.253:443

69.119.185.172:995

72.29.181.77:2083

174.131.181.120:995

137.119.216.25:443

207.162.184.228:443

65.30.12.240:995

190.120.196.18:443

206.51.202.106:50002

80.14.209.42:2222

76.80.66.226:443

173.178.129.3:443

181.90.124.162:443

96.22.239.27:2222

78.94.55.26:50003

24.201.68.105:2078

197.89.78.191:995

108.184.57.213:8443

181.126.80.118:443

Targets

    • Target

      b558197d8287ef724b6e7af39116450dd2e7bfcfd2b02f6f637fb9f8979aa83c

    • Size

      1.9MB

    • MD5

      fe0dfda0d0a36461e119e26f933fdc2a

    • SHA1

      a0214a28a7436eeb7df73f8a76657d33cc78fd34

    • SHA256

      b558197d8287ef724b6e7af39116450dd2e7bfcfd2b02f6f637fb9f8979aa83c

    • SHA512

      531a5cc0df24666f21d36fbd3bbc9916c5f202cf16707aaea5bcc15302ce1ede564173ce2b657c8a089c00e7f2b27290a5a18928b28728b4ad684656fed14efc

    Score
    10/10
    qakbotspx241571222456bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks