qakbot | 614c0d45e6384c2dc41e4003d86b6ef22cac5963756b5b07214d5399e7173d4c

Sharing

Copy URL Twitter E-mail

General

Target
e35727b10193fe55df216a1f9d166997.bin
Size 469KB
Sample230601-b86ltacd7s
SHA256 614c0d45e6384c2dc41e4003d86b6ef22cac5963756b5b07214d5399e7173d4c
MD5 6d099138bca6d563a18d7ad4e3a52dbc
SHA1 4450166a7ac725c1ed80a79ce744e2aa2bb9971d
SHA512 2263e8b6d8554c8f96fdc55272b918bf8716a7a7499e47f52cd536483e02c0f6dcdc248118d737c8f1d5c05002109f60d029c8cea7956901fc54b09a3e2b6e3f
SSDEEP 12288:N+Uu0ua/Z6REVC/vEFe2cKmpw+R22MUn8maHZyJ9Mrog:gg/Z6RrXEFFcvm3HUnvdJ9Fg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.1320

Botnet

obama265

Campaign

1685436052

103.42.86.42:995
174.4.89.3:443
161.142.103.187:995
78.160.146.127:443
84.35.26.14:995
12.172.173.82:20
70.28.50.223:2078
124.149.143.189:2222
70.160.67.203:443
186.64.67.30:443
103.123.223.133:443
94.207.104.225:443
89.114.140.100:443
213.64.33.61:2222
86.176.144.234:2222
72.134.124.16:443
47.34.30.133:443
109.50.149.241:2222
85.104.105.67:443
81.111.108.123:443
86.173.2.12:2222
188.28.19.84:443
41.228.224.161:995
12.172.173.82:50001
178.175.187.254:443
65.95.141.84:2222
205.237.67.69:995
83.110.223.61:443
193.253.100.236:2222
27.0.48.233:443
102.159.188.125:443
71.38.155.217:443
58.186.75.42:443
76.178.148.107:2222
70.28.50.223:2087
114.143.176.236:443
51.14.29.227:2222
59.28.84.65:443
173.88.135.179:443
103.144.201.56:2078
96.87.28.170:2222
105.184.103.97:995
176.142.207.63:443
151.62.238.176:443
12.172.173.82:32101
122.186.210.254:443
82.125.44.236:2222
84.108.200.161:443
76.16.49.134:443
70.28.50.223:32100
12.172.173.82:465
76.170.252.153:995
184.182.66.109:443
78.92.133.215:443
50.68.204.71:993
186.75.95.6:443
113.11.92.30:443
70.28.50.223:3389
98.145.23.67:443
85.57.212.13:3389
50.68.186.195:443
47.205.25.170:443
12.172.173.82:993
12.172.173.82:22
69.242.31.249:443
81.101.185.146:443
79.168.224.165:2222
75.143.236.149:443
14.192.241.76:995
86.195.14.72:2222
81.229.117.95:2222
220.240.164.182:443
73.29.92.128:443
12.172.173.82:21
96.56.197.26:2222
75.109.111.89:443
76.86.31.59:443
201.244.108.183:995
68.203.69.96:443
124.122.47.148:443
122.184.143.86:443
92.186.69.229:2222
70.28.50.223:2083
89.129.109.27:2222
147.147.30.126:2222
125.99.76.102:443
88.126.94.4:50000
151.65.167.77:443
86.132.236.117:443
92.154.17.149:2222
223.166.13.95:995
89.36.206.69:995
96.56.197.26:2083
78.18.105.11:443
82.127.153.75:2222
90.78.147.141:2222
82.131.141.209:443
183.87.163.165:443
92.9.45.20:2222
80.6.50.34:443
80.12.88.148:2222
69.133.162.35:443
172.115.17.50:443
95.45.50.93:2222
12.172.173.82:2087
103.140.174.20:2222
24.198.114.130:995
50.68.204.71:443
69.119.123.159:2222
64.121.161.102:443
2.82.8.80:443
184.181.75.148:443
70.112.206.5:443
198.2.51.242:993
2.36.64.159:2078
79.77.142.22:2222
84.215.202.8:443
147.219.4.194:443
116.74.164.81:443

Targets

- Target
  696156d9a4117cba652b18b012db376fddfbd7db8b26a638c760d61b98d3590d.msi
- Size 496KB
- SHA256 696156d9a4117cba652b18b012db376fddfbd7db8b26a638c760d61b98d3590d
- MD5 e35727b10193fe55df216a1f9d166997
- SHA1 9ddafa77fc9fdea0085e41aa0f3a1ee0d15d9c8a
- SHA512 2bba74b0b7f5ee8509310030bb45def13b87394e55edf8d0e51595d6cc669f4b2c7497d95331c09c9f7b453f3c9acdeb03e41cd5e5dc14f9ecb9dd9f79d7ad8d
- SSDEEP 12288:wn+NgINNEcfjVRMigNFoILI8KviLjvhAol71Q:wnX9gjVRMDqH8fL154
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot obama265 1685436052 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2