qakbot | 7de40390c0bff0a96586c984853bd650472e1975aaf88ac7df35e81b05b07e46

General

Target

15524B56B8C0E92485A375F76BEEF76D.dll
Size

1.0MB
Sample

220916-zzezhagfc7
MD5

15524b56b8c0e92485a375f76beef76d
SHA1

188d63b804ec86b2f1f62a2c7ce738868dff5f20
SHA256

7de40390c0bff0a96586c984853bd650472e1975aaf88ac7df35e81b05b07e46
SHA512

b5cc07eeec0919cc6bbed5df43aa8e491b8137b42bfc09e924316b1dd3d94aee46f33263ac220f7ca8f95419cb13dc03022d95a352d6bcf7500a05d0366d692f
SSDEEP

12288:RkkiAYQjSOklPGSTHmI6S9+XruiCtDhBCaATfT0sBkPzXTwnm1cQ47glckpPWUJR:HdhSlNKIybLKFBC1jNRZVdobzJLAspx

Score

10^/10

qakbot bb 1663323048 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

BB

Campaign

1663323048

C2

200.161.62.126:32101

70.51.132.197:2222

78.100.228.93:995

78.100.225.34:2222

179.111.111.88:32101

102.38.97.72:995

217.165.68.125:993

193.3.19.37:443

70.49.33.200:2222

31.54.39.153:2078

99.232.140.205:2222

119.82.111.158:443

134.35.10.207:443

45.51.148.111:993

186.154.92.181:443

66.181.164.43:443

41.96.56.224:443

88.231.221.198:995

76.169.76.44:2222

68.53.110.74:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  
  15524B56B8C0E92485A375F76BEEF76D.dll
- Size
  
  1.0MB
- MD5
  
  15524b56b8c0e92485a375f76beef76d
- SHA1
  
  188d63b804ec86b2f1f62a2c7ce738868dff5f20
- SHA256
  
  7de40390c0bff0a96586c984853bd650472e1975aaf88ac7df35e81b05b07e46
- SHA512
  
  b5cc07eeec0919cc6bbed5df43aa8e491b8137b42bfc09e924316b1dd3d94aee46f33263ac220f7ca8f95419cb13dc03022d95a352d6bcf7500a05d0366d692f
- SSDEEP
  
  12288:RkkiAYQjSOklPGSTHmI6S9+XruiCtDhBCaATfT0sBkPzXTwnm1cQ47glckpPWUJR:HdhSlNKIybLKFBC1jNRZVdobzJLAspx
Score

10^/10

qakbot bb 1663323048 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2