Extracted

• • Target

    ContractCopy3862.html

  • Size

    978KB

  • MD5

    1118f053697a3048b19099fb2acd284a

  • SHA1

    dee050fc962253582dd0660f648a69a11b364f92

  • SHA256

    9f7eb4e5382c19d8e3ecbc71f13aaf467df4f61a835fee78ca199bdd3b7178ca

  • SHA512

    c0247925481973b621d263ecfa7c68c85ba6b8f6fcbfa2eb283cbad8b8e13dd0df015a34b8985526a956b010f588960ed347f0d24d60969667f2b88c48b82bcc

  • SSDEEP

    24576:D0R0eQGLbURy4/kZf1CvbWs3O0IITkgPGW3MK:D0lylhaIfL

  Score

  10^/10

  qakbotobama2221668692319bankerdiscoveryspywarestealertrojan

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1