Malware sandboxing report by Hatching Triage

General

Target

c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
Size

597KB
Sample

221205-1qkdasag75
MD5

13bd4a09264d6312d957d61d64e79f53
SHA1

5ebf19ba1be83ad9e15991e76e509a57aaa9e9c0
SHA256

c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
SHA512

b7943be0b78a7de293b19e2b75a6b44bae34997c555e1a83a0064087d828616e601cc04cb8f13e6e44e8b9cb67fe2328b3826c8d31edf8cd5a74e9def710e582
SSDEEP

12288:rZzDzxF3RR3sSRogrrYW4OH5IBwBZ3TzChsL4o1U:rZzDzvvRoCBH2WBJChsMo1U

Score

10^/10

qakbot aa 1649749884 banker stealer trojan

Malware Config

Extracted

Family	qakbot
Version	403.573
Botnet	AA
Campaign	1649749884
C2	120.150.218.241:995 186.64.67.38:443 196.203.37.215:80 1.161.71.109:443 82.152.39.39:443 76.69.155.202:2222 72.66.116.235:995 103.107.113.120:443 113.11.89.165:995 208.107.221.224:443 103.88.226.30:443 75.99.168.194:443 75.113.214.234:2222 76.169.147.192:32103 190.73.3.148:2222 39.52.2.90:995 38.70.253.226:2222 5.95.58.211:2087 74.15.2.252:2222 76.70.9.169:2222 121.74.167.191:995 197.167.62.14:993 108.60.213.141:443 47.23.89.62:993 86.97.247.20:2222 47.23.89.62:995 176.67.56.94:443 86.98.33.251:443 96.37.113.36:993 148.64.96.100:443 47.180.172.159:443 140.82.49.12:443 80.11.74.81:2222 96.21.251.127:2222 177.158.7.155:443 125.168.47.127:2222 41.228.22.180:443 181.208.248.227:443 81.215.196.174:443 105.226.83.196:995 176.88.238.122:995 46.107.48.202:443 24.43.99.75:443 172.115.177.204:2222 180.129.102.214:995 2.50.137.197:443 78.87.206.213:995 72.76.94.99:443 66.98.42.102:443 109.228.220.196:443 75.99.168.194:61201 71.13.93.154:2222 45.9.20.200:443 173.174.216.62:443 31.35.28.29:443 93.48.80.198:995 32.221.224.140:995 203.122.46.130:443 47.180.172.159:50010 187.207.48.194:61202 39.44.144.159:995 92.132.172.197:2222 176.205.119.81:2078 144.202.2.175:995 45.76.167.26:995 149.28.238.199:995 45.76.167.26:443 144.202.2.175:443 144.202.3.39:995 45.63.1.12:995 140.82.63.183:995 144.202.3.39:443 149.28.238.199:443 45.63.1.12:443 140.82.63.183:443 63.143.92.99:995 70.46.220.114:443 103.87.95.133:2222 1.161.71.109:995 117.248.109.38:21 180.183.97.165:2222 86.97.11.43:443 202.134.152.2:2222 39.57.23.116:995 91.177.173.10:995 217.128.122.65:2222 24.178.196.158:2222 37.210.164.171:2222 37.186.54.254:995 86.98.208.214:2222 83.110.75.225:2222 174.69.215.101:443 217.165.147.83:993 172.114.160.81:995 84.241.8.23:32103 111.125.245.118:995 173.21.10.71:2222 182.191.92.203:995 191.99.191.28:443 73.151.236.31:443 119.158.121.244:995 71.74.12.34:443 101.50.103.193:995 47.158.25.67:443 187.172.232.250:443 47.156.191.217:443 187.250.114.15:443 187.195.19.24:443 201.145.189.252:443 72.252.201.34:990 72.252.201.34:995 45.46.53.140:2222 190.252.242.69:443 187.251.132.144:22 181.62.0.59:443 72.12.115.90:22 103.246.242.202:443 100.1.108.246:443 191.17.223.222:32101 40.134.246.185:995 24.55.67.176:443 109.12.111.14:443 90.120.65.153:2078 179.158.105.44:443 72.252.201.34:993 201.103.199.197:443 37.34.253.233:443 70.51.138.126:2222 187.102.135.142:2222 187.52.231.156:443 86.97.247.20:1194 41.84.242.5:995 186.105.121.166:443 31.48.166.122:2078 89.137.52.44:443 96.29.208.97:443 85.74.48.5:995 197.205.101.36:443 102.182.232.3:995 86.195.158.178:2222 217.164.210.192:443 197.89.8.167:443 201.211.64.196:2222 45.241.202.203:995 175.145.235.37:443 86.98.33.141:995 85.246.82.244:443 43.252.72.97:2222 67.209.195.198:990 41.38.167.179:995 120.150.218.241:995 186.64.67.38:443 196.203.37.215:80 1.161.71.109:443 82.152.39.39:443 76.69.155.202:2222 72.66.116.235:995 103.107.113.120:443 113.11.89.165:995 208.107.221.224:443 103.88.226.30:443 75.99.168.194:443 75.113.214.234:2222 76.169.147.192:32103 190.73.3.148:2222 39.52.2.90:995 38.70.253.226:2222 5.95.58.211:2087 74.15.2.252:2222 76.70.9.169:2222 121.74.167.191:995 197.167.62.14:993 108.60.213.141:443 47.23.89.62:993 86.97.247.20:2222 47.23.89.62:995 176.67.56.94:443 86.98.33.251:443 96.37.113.36:993 148.64.96.100:443 47.180.172.159:443 140.82.49.12:443 80.11.74.81:2222 96.21.251.127:2222 177.158.7.155:443 125.168.47.127:2222 41.228.22.180:443 181.208.248.227:443 81.215.196.174:443 105.226.83.196:995 176.88.238.122:995 46.107.48.202:443 24.43.99.75:443 172.115.177.204:2222 180.129.102.214:995 2.50.137.197:443 78.87.206.213:995 72.76.94.99:443 66.98.42.102:443 109.228.220.196:443 75.99.168.194:61201 71.13.93.154:2222 45.9.20.200:443 173.174.216.62:443 31.35.28.29:443 93.48.80.198:995 32.221.224.140:995 203.122.46.130:443 47.180.172.159:50010 187.207.48.194:61202 39.44.144.159:995 92.132.172.197:2222 176.205.119.81:2078 144.202.2.175:995 45.76.167.26:995 149.28.238.199:995 45.76.167.26:443 144.202.2.175:443 144.202.3.39:995 45.63.1.12:995 140.82.63.183:995 144.202.3.39:443 149.28.238.199:443 45.63.1.12:443 140.82.63.183:443 63.143.92.99:995 70.46.220.114:443 103.87.95.133:2222 1.161.71.109:995 117.248.109.38:21 180.183.97.165:2222 86.97.11.43:443 202.134.152.2:2222 39.57.23.116:995 91.177.173.10:995 217.128.122.65:2222 24.178.196.158:2222 37.210.164.171:2222 37.186.54.254:995 86.98.208.214:2222 83.110.75.225:2222 174.69.215.101:443 217.165.147.83:993 172.114.160.81:995 84.241.8.23:32103 111.125.245.118:995 173.21.10.71:2222 182.191.92.203:995 191.99.191.28:443 73.151.236.31:443 119.158.121.244:995 71.74.12.34:443 101.50.103.193:995 47.158.25.67:443 187.172.232.250:443 47.156.191.217:443 187.250.114.15:443 187.195.19.24:443 201.145.189.252:443 72.252.201.34:990 72.252.201.34:995 45.46.53.140:2222 190.252.242.69:443 187.251.132.144:22 181.62.0.59:443 72.12.115.90:22 103.246.242.202:443 100.1.108.246:443 191.17.223.222:32101 40.134.246.185:995 24.55.67.176:443 109.12.111.14:443 90.120.65.153:2078 179.158.105.44:443 72.252.201.34:993 201.103.199.197:443 37.34.253.233:443 70.51.138.126:2222 187.102.135.142:2222 187.52.231.156:443 86.97.247.20:1194 41.84.242.5:995 186.105.121.166:443 31.48.166.122:2078 89.137.52.44:443 96.29.208.97:443 85.74.48.5:995 197.205.101.36:443 102.182.232.3:995 86.195.158.178:2222 217.164.210.192:443 197.89.8.167:443 201.211.64.196:2222 45.241.202.203:995 175.145.235.37:443 86.98.33.141:995 85.246.82.244:443 43.252.72.97:2222 67.209.195.198:990 41.38.167.179:995
Attributes	salt jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
- Size
  
  597KB
- MD5
  
  13bd4a09264d6312d957d61d64e79f53
- SHA1
  
  5ebf19ba1be83ad9e15991e76e509a57aaa9e9c0
- SHA256
  
  c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
- SHA512
  
  b7943be0b78a7de293b19e2b75a6b44bae34997c555e1a83a0064087d828616e601cc04cb8f13e6e44e8b9cb67fe2328b3826c8d31edf8cd5a74e9def710e582
- SSDEEP
  
  12288:rZzDzxF3RR3sSRogrrYW4OH5IBwBZ3TzChsL4o1U:rZzDzvvRoCBH2WBJChsMo1U
Score

10^/10

qakbot aa 1649749884 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Blocklisted process makes network request

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2