qakbot | 4b1b586d7eaf39f8d8d00ba2192562bc831069af1f73d0bd0202c858dbf1d094

General

Target

4b1b586d7eaf39f8d8d00ba2192562bc831069af1f73d0bd0202c858dbf1d094
Size

402KB
Sample

221130-xnes9afd38
MD5

1e5b64a4b48d53666f991c1183efc22a
SHA1

c066acac2259d2b658fa8995d851b70dd26d54f9
SHA256

4b1b586d7eaf39f8d8d00ba2192562bc831069af1f73d0bd0202c858dbf1d094
SHA512

4033acfe9a614032dc6474da57ce644b2e86130393db277d57caf9da65c755dff5eae7d1e78b590f0a3d0bf85537da31d4ec71c72415616d0db53f2c9d4a6df0
SSDEEP

6144:JyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm:tTwr03pdf8vhhOKJET5By

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama05

Campaign

1613729859

C2

86.160.137.132:443

172.87.157.235:3389

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

188.25.63.105:443

71.117.132.169:443

193.248.221.184:2222

85.52.72.32:2222

87.202.87.210:2222

78.185.59.190:443

2.7.116.188:2222

81.97.154.100:443

24.50.118.93:443

98.121.187.78:443

108.29.32.251:443

24.152.219.253:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  4b1b586d7eaf39f8d8d00ba2192562bc831069af1f73d0bd0202c858dbf1d094
- Size
  
  402KB
- MD5
  
  1e5b64a4b48d53666f991c1183efc22a
- SHA1
  
  c066acac2259d2b658fa8995d851b70dd26d54f9
- SHA256
  
  4b1b586d7eaf39f8d8d00ba2192562bc831069af1f73d0bd0202c858dbf1d094
- SHA512
  
  4033acfe9a614032dc6474da57ce644b2e86130393db277d57caf9da65c755dff5eae7d1e78b590f0a3d0bf85537da31d4ec71c72415616d0db53f2c9d4a6df0
- SSDEEP
  
  6144:JyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm:tTwr03pdf8vhhOKJET5By
Score

10^/10

qakbot obama05 1613729859 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2