Overview

overview

10

Static

static

1

e88610db05...15.msi

windows7-x64

10

e88610db05...15.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115.zip

  • Size

    1.2MB

  • Sample

    240402-mnqweafg47

  • MD5

    8cafad2a93545b3ac6008f3376f201a4

  • SHA1

    b50a7f18e4416a0480a728f013a743babcf97169

  • SHA256

    b2372de70a5f34110e015a3a3835cc2eea85a187c2a7380d6c1330e10f8870f2

  • SHA512

    b3e60d332d9ef6ab3f72ae3265eea95bc28c8b52fda824f7c4f7a9ab05d4668d3703602bcbb22e973b137b297c523d67e52aa960e752ca21919386162d31880a

  • SSDEEP

    24576:jQN5/mYAvN3PY0QcsLo/7vsw1Ns/jl+NGwaf4v8Ha/BAUY:jQNwY2XTvzvuQPagHY

Score
10/10
qakbottchk071702975817bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

tchk07

Campaign

1702975817

C2

116.203.56.11:443

109.107.181.8:443
Attributes
  • camp_date

    2023-12-19 08:50:17 +0000 UTC

Targets

    • Target

      e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115.msi

    • Size

      2.1MB

    • MD5

      723dae8ed3f157e40635681f028328e6

    • SHA1

      aa6dd8df02000fbfc884e687bcafed57f84a83b0

    • SHA256

      e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115

    • SHA512

      4e1829bfc470ea8624dee424db34b2b0f965597c1e300ca62f271727a7fd4dc6c90137d5ca8fd227ba3bad26fee2870788f91b00b225d6a626e99e18476473be

    • SSDEEP

      49152:DNGitd+vszAlozTy4g5r8+5eNBADPGXJXrejhJ8I+jELv6:oihTyfIXreNJ8IpT6

    Score
    10/10
    qakbottchk071702975817bankerstealertrojan

    • Detect Qakbot Payload

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks