Extracted

• • Target

    c625a4b7-29ac-449e-a26c-3c23e734b6f0.html

  • Size

    902KB

  • MD5

    ccac45f1b5f6ed78c79e9664cf94061c

  • SHA1

    4002f24d14241e295e60eb84e9fb1c8f44d2e1e7

  • SHA256

    6b5cbe2f06bd326c2dd884c2852771d1a4a37e8a5e915301ff06e37b0fed8f02

  • SHA512

    b8b38413c400b02dd739dfd3871d8ea92ecbf7e9dfdbd9e56fc1d09262fa1b08017d3d8a4722e10166b549e80a74d5fc9a748dfd068bac93fb1927b58f5048c6

  • SSDEEP

    12288:wv7zjoA2MUv/EAAs0W6D3LjpDepyVYDUNPKfTMNVU37CCJE6sq26:ez0/BHFAsS/ZebUlKfT0oWp6

  Score

  10^/10

  qakbotbankerpersistencestealertrojan

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1