qakbot | ba7dcbf926cdfa0bb93992ac5a03d178c41ed9532f3b16f6e6534e02a8d247a2 | Triage™

Resubmissions

04/11/2022, 15:53

221104-tby5ksgeg410

04/11/2022, 15:29

221104-swwphsgdc43

04/11/2022, 14:47

221104-r52rfsgbc210

Sharing

Copy URL Twitter E-mail

General

Target
D6.zip
Size 438KB
Sample221104-r52rfsgbc2
SHA256 ba7dcbf926cdfa0bb93992ac5a03d178c41ed9532f3b16f6e6534e02a8d247a2
MD5 8ba3564843f1ad7f3b3a9740076d7306
SHA1 540d05eb64cb8507c9d654342d10f7dafca63128
SHA512 3de27541f416376843c46f4c85787481711060ec7d1c574ce3c3b79e8c7f36823415e24ec895d7ceaa1748b14b2f6067dc56cc11ff20366b9f8c166ac956cb8d
SSDEEP 6144:chITo+0nZF+V/VaIS2MRaCQ4EPQEqpjBK3Vk7nljfbV7jZkLElZC6MGWlqrJNe8:g+0S/AXxsQrq3VinlNlZfPS4j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot bb05 1667470599 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.20

Botnet

BB05

Campaign

1667470599

C2

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  D6.zip
- Size 438KB
- SHA256 ba7dcbf926cdfa0bb93992ac5a03d178c41ed9532f3b16f6e6534e02a8d247a2
- MD5 8ba3564843f1ad7f3b3a9740076d7306
- SHA1 540d05eb64cb8507c9d654342d10f7dafca63128
- SHA512 3de27541f416376843c46f4c85787481711060ec7d1c574ce3c3b79e8c7f36823415e24ec895d7ceaa1748b14b2f6067dc56cc11ff20366b9f8c166ac956cb8d
- SSDEEP 6144:chITo+0nZF+V/VaIS2MRaCQ4EPQEqpjBK3Vk7nljfbV7jZkLElZC6MGWlqrJNe8:g+0S/AXxsQrq3VinlNlZfPS4j
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  SS2998.zip
- Size 438KB
- SHA256 ab4ac0a5e271a74d6810d3091ffe1db3f6c6eba23f78b4beec3fee6ef20e1b44
- MD5 96c19e846706b35c669b1f23fc2d11cd
- SHA1 94c11b0d2172986e95b8cbecdd3c881c4a16fe0c
- SHA512 2ed146cb6669120c2b6647f3798f959a9cbb21b90eb019d4e12b80c029f1d6bfcb643d3172e461c13accd6c96fa44fa33baaa288b1c41a7d42b973c17570e43b
- SSDEEP 6144:jhITo+0nZF+V/VaIS2MRaCQ4EPQEqpjBK3Vk7nljfbV7jZkLElZC6MGWlqrJNee:z+0S/AXxsQrq3VinlNlZfPS4R
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  SS2998.iso
- Size 880KB
- SHA256 36b2c48010dcfe4d6fdb44dc88e6dd9464e01ffb93cb1f588a54b26b88bd45dc
- MD5 97e99f43a299e885584157567a52a24f
- SHA1 6b3a205f9428d8e0b1894e2098d094d7eba0ceea
- SHA512 0b63f32c5dbed801876bc5ef5e17ca3ca50426879d88bd5a14e763014a8894584fff09195173477d82b01ba3e7d118529d687802a2845849133fd1b26084d17b
- SSDEEP 24576:00OHDiTF6jT5GKg3J8M2Yum7p8NCuPvU6PX:00OHeUWx2I7sCuPHP
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  SS.lnk
- Size 1KB
- SHA256 204339e1c32768cd21548e785433ee3e94d7de6d243c4bc1b8b388815d94d28c
- MD5 6be437c70c2ddced62b523f7dc8c4ff6
- SHA1 edde62ddbc8199b01ef1312b627c269857d3f328
- SHA512 2f300496abf6b5bf32a462f7182bb251ddb3256b3403230b37a8198a7ffc158141a307810f9641fc78998f1460669ae803df4cab39c5052d24f66820175ef89d
- MD5 SHA1 SHA512
Score

3^/10
behavioral7 behavioral8
- Target
  pressurization/barmaid.txt
- Size 55KB
- SHA256 411edda10cb7f779895889c506d6e39f988b7102372b620b7f4aa66aec9a0e44
- MD5 78307784d064fc1cf77dda8620116115
- SHA1 d9a2c5412859a77874edbdbfda5837c68edaf1fa
- SHA512 3039fb2524dcae2ad4f35f73956db51163dde1574bc393ee6013f0931d74a0413ef9a8333b484f2ed23c7360ee7c74b18b9ad02b038010b905c9c86a9d6c67f3
- SSDEEP 768:dlbURjBM+ohKxviKxIbDKxviOcbURjBM+ohKLiUBInTtwjUAhZohZLNSh5QfInTH:LaB/fxvYWxvrcaB/fLNU8ZsGuZw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  pressurization/dissecting.bat
- Size 228B
- SHA256 07b41a33bef6dc946380246890d68ba54a2861b173c5250631dc65cf27468e5e
- MD5 e4abed567a6ebb24750efd8e8572e648
- SHA1 c8d94bb9033208537398051551fb5d85ea2fe509
- SHA512 819e361f5b3164d36b73a10505f25331e5f8ff92d747ef8c1eb0367e93199e5ba7644fe2f4de68dff66d1f4399caaa9a8b49eb8656fab6033fe3ce4a3eb8bcb6
- MD5 SHA1 SHA512
Score

1^/10
behavioral11 behavioral12
- Target
  pressurization/exasperater.cmd
- Size 259B
- SHA256 4e078b7dd845b58b09566cce89cce3eb8d0ef576c042574702e3ede24881e308
- MD5 f14cbf707cd69cbfe61dedc40595cb11
- SHA1 abe513e9d35f3797b220f191a2717808758061a1
- SHA512 ebd77054c56ea608c9d940dc60bfdf193110b5dfa457c933c4d609d37d3c2908bbffed7807406ce913e93c32017131431987f9a5eb728be68dc76b32de203169
- MD5 SHA1 SHA512
Score

1^/10
behavioral13 behavioral14
- Target
  pressurization/lineal.dat
- Size 755KB
- SHA256 d24ba82ea5c24288f1ad640198eaa19e513e4bfa17145c406e0cd3f10069b4e5
- MD5 1ebd27618b41e501d574a5e2036131e4
- SHA1 f0fbf97f3b1737d62255c57640262748ac0293bc
- SHA512 36706d91787bbbf78802450a3f574209dbae6c08b81d322f08fce688a9376471de4a526c7c9a0f496b9322a6e73e4069eb23acd87759087d5b2b2fd4e547c09f
- SSDEEP 12288:FN53TigGAAaYOjrtguXsmPKtbKgvAAfRcJtjm/1kJYuqd7pJeG5mCuq6vU6Pm:FHDiTF6jT5GKg3J8M2Yum7p8NCuPvU6e
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot bb05 1667470599 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral15 behavioral16
- Target
  pressurization/nosebags.png
- Size 6KB
- SHA256 0bedcd767bb68a934926faa77209a448767b795e6ac538c712ce53847de2f5ba
- MD5 114587fe936bc26ad00afc63f87fa9aa
- SHA1 b25c09dc3ff83873faf9371f62ae85a692ee6cbc
- SHA512 4e552af0f83b6e3667fffc375202616797fcbbc4671cb2759ef31b37d654814ec91237b34b68c97d9b6f6c9351804445ecb5198d45befc50f1104bf9ff1f6ed4
- SSDEEP 96:iQ57LJ3TRWPjLaeGw7Zl7unZNK4s/89rQMyIPbrRpmhwDKPHTHlfWj2el4:zb3TwrLL7Zl7uY86MyITCv/TlfWqel4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

qakbotbb051667470599bankerstealertrojan

behavioral16

qakbotbb051667470599bankerstealertrojan

behavioral17

behavioral18