Overview

overview

10

Static

static

1309.dll

windows7-x64

10

1309.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1309.bin

  • Size

    401KB

  • Sample

    220913-p4hk3sbddq

  • MD5

    44255200f634646100d6e71e8f5ae7d7

  • SHA1

    ecb47e47e31247d8969ab48a629f2bc2e6cfecec

  • SHA256

    57e28579e8cd60487ca71115bd4367ba45bee5a7e3ea78023bc817d4699c3c9f

  • SHA512

    575e1e4057573df904c34da51ddeb100ec56f762b6f034f6ecb9f938384606e58fb507b4b8a75cdb6ece8ed8a09578f84f0cbf4b269e00a3e7fcc2df2ec04229

  • SSDEEP

    12288:9zlWXAEum0intq9k7PPsVcELe8IrHpDzl/qlhgs:9zQXAEujEQu7Iu8IrHTylhg

Score
10/10
qakbotbb1663053540bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

BB

Campaign

1663053540

C2

194.49.79.231:443

193.3.19.37:443

99.232.140.205:2222

47.146.182.110:443

84.38.133.191:443

191.97.234.238:995

37.210.148.30:995

64.207.215.69:443

200.161.62.126:32101

88.245.103.132:2222

86.98.156.176:993

175.110.231.67:443

78.100.254.17:2222

191.84.204.214:995

123.240.131.1:443

197.94.210.133:443

196.92.172.24:8443

186.50.245.74:995

70.51.132.197:2222

100.1.5.250:995
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      1309.bin

    • Size

      401KB

    • MD5

      44255200f634646100d6e71e8f5ae7d7

    • SHA1

      ecb47e47e31247d8969ab48a629f2bc2e6cfecec

    • SHA256

      57e28579e8cd60487ca71115bd4367ba45bee5a7e3ea78023bc817d4699c3c9f

    • SHA512

      575e1e4057573df904c34da51ddeb100ec56f762b6f034f6ecb9f938384606e58fb507b4b8a75cdb6ece8ed8a09578f84f0cbf4b269e00a3e7fcc2df2ec04229

    • SSDEEP

      12288:9zlWXAEum0intq9k7PPsVcELe8IrHpDzl/qlhgs:9zQXAEujEQu7Iu8IrHTylhg

    Score
    10/10
    qakbotbb1663053540bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks