Overview

overview

10

Static

static

1

e88610db05...15.msi

windows7-x64

10

e88610db05...15.msi

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115.zip

  • Size

    1.2MB

  • Sample

    240302-xxmkfsgc3s

  • MD5

    d4d7e36f309b1587e6e536aa840f35b5

  • SHA1

    673f6f227c57d6ff8a90f59b2d6a3be1897ae90e

  • SHA256

    6bf07c627ad8bd576633f65a96cbb8753515fc72929cb904b21440015e1c2218

  • SHA512

    6ae643a72d29525664b9e8ae05ce97af265c5312564a69401e7e9024b6449421566d660c028c25ad7e356f48d388c0d22c187507b9156fa49f5fa3905fb06101

  • SSDEEP

    24576:ZoLOCNWaEM9DmRTBGr7ytiziGoPCI88SIu1tE6sM2Xn4CTYvE:6LOMbHZmRFRFqI88Bu1a6V64CX

Score
10/10
qakbottchk071702975817bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

tchk07

Campaign

1702975817

C2

116.203.56.11:443

109.107.181.8:443
Attributes
  • camp_date

    2023-12-19 08:50:17 +0000 UTC

Targets

    • Target

      e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115.msi

    • Size

      2.1MB

    • MD5

      723dae8ed3f157e40635681f028328e6

    • SHA1

      aa6dd8df02000fbfc884e687bcafed57f84a83b0

    • SHA256

      e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115

    • SHA512

      4e1829bfc470ea8624dee424db34b2b0f965597c1e300ca62f271727a7fd4dc6c90137d5ca8fd227ba3bad26fee2870788f91b00b225d6a626e99e18476473be

    • SSDEEP

      49152:DNGitd+vszAlozTy4g5r8+5eNBADPGXJXrejhJ8I+jELv6:oihTyfIXreNJ8IpT6

    Score
    10/10
    qakbottchk071702975817bankerstealertrojan

    • Detect Qakbot Payload

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks