qakbot | a9667421d92708fdeda118f75916afd6a904fbcf2ba85c1fd7d41d14021137b9

General

Target

WI34.img
Size

970KB
Sample

221118-bw7cksgc57
MD5

c183d13389f1e6418b6992e717d8cb68
SHA1

8461fd13a2f5986fbdca62dcb6870f6bf0cfec91
SHA256

a9667421d92708fdeda118f75916afd6a904fbcf2ba85c1fd7d41d14021137b9
SHA512

7da9ecde9b0d3f00faff43bf73db25aaa1fb0cba5ed55cffd37bd07c7a4630f8dc033b7c4689c4ec92255ff1c81eeb043bd71219b5692560059d08b319c1e53e
SSDEEP

12288:xouKwnONVvoo6F+DfZxL4+Dir8lkQ5z4hbDmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:xouKw9o6F+DRt4Tr8lkBhPp2QOU

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668670510

C2

86.225.214.138:2222

71.183.236.133:443

182.66.197.35:443

70.66.199.12:443

76.80.180.154:995

180.151.104.143:443

92.149.205.238:2222

83.110.223.247:443

183.87.31.34:443

105.103.50.1:990

103.141.50.117:995

105.103.50.1:465

105.103.50.1:22

86.130.9.167:2222

86.99.15.243:2222

90.104.22.28:2222

172.117.139.142:995

176.142.207.63:443

142.161.27.232:2222

71.247.10.63:50003

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  
  WI34.img
- Size
  
  970KB
- MD5
  
  c183d13389f1e6418b6992e717d8cb68
- SHA1
  
  8461fd13a2f5986fbdca62dcb6870f6bf0cfec91
- SHA256
  
  a9667421d92708fdeda118f75916afd6a904fbcf2ba85c1fd7d41d14021137b9
- SHA512
  
  7da9ecde9b0d3f00faff43bf73db25aaa1fb0cba5ed55cffd37bd07c7a4630f8dc033b7c4689c4ec92255ff1c81eeb043bd71219b5692560059d08b319c1e53e
- SSDEEP
  
  12288:xouKwnONVvoo6F+DfZxL4+Dir8lkQ5z4hbDmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:xouKw9o6F+DRt4Tr8lkBhPp2QOU
Score

3^/10
behavioral1 behavioral2
- Target
  
  WW.js
- Size
  
  9KB
- MD5
  
  558430d02887b5a840b78776f13fceda
- SHA1
  
  8d632f98ed740405eefbf6ea6c0f8b320df2a1e6
- SHA256
  
  cff806496c39381fea28ea2a501c669ca8aada38dfa9b37ee13a7ed206ef4e63
- SHA512
  
  9555f8565ef810e296f0469e272758f6f4739983dd8ecd258239a76b0b7e001cbd06957b6d0eb84fde07a99648062db613ab34c5229d714f88a0d97c7951f27d
- SSDEEP
  
  192:SSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:9Vq2k785UIro8KTMhSeYm5P2jiuuEjP4
Score

10^/10

qakbot bb06 1668670510 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  
  animators/valuable.tmp
- Size
  
  835KB
- MD5
  
  3923dda28248cab18c1d1a223b039f47
- SHA1
  
  1263d839f8ab476b93b606e1227b7b35c6ae1d7d
- SHA256
  
  5efab4e49bac08d9cb062010a9385369aa16bf6970fd1338d02ecfea1b93c52a
- SHA512
  
  8b7c4da763acc3b587846f8dbac26a0885ab53b86f4bf5bb11a4a76d9c9ee71e58783e69489df06856ca342996e5716ffc98fc4dc7aa969ea990a900e1167905
- SSDEEP
  
  12288:T6F+DfZxL4+Dir8lkQ5z4hbDmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:T6F+DRt4Tr8lkBhPp2QOU
Score

10^/10

qakbot bb06 1668670510 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral5 behavioral6

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Checks computer location settings

Qakbot/Qbot

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6