Overview

overview

10

Static

static

1

e88610db05...15.msi

windows7-x64

10

e88610db05...15.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115.zip

  • Size

    1.2MB

  • Sample

    240402-qeblxaag6y

  • MD5

    6894809716f73c4645e0abaab01dd442

  • SHA1

    4026a8787963c6ff6f0f934964f500484b201ba1

  • SHA256

    51c7477f1878e4c676029a2c2b628f1051da68f6df95806f3f79e382d1e488b5

  • SHA512

    1fa2f2ca538cd33b7d3b7b0cf584d8db27576dfacacbaf8834298a7bda3d3b7e001618b76bf234a09132ba9a4c742bc3469bee7ae28359b4d8bedf5cf6909cf3

  • SSDEEP

    24576:V/GD3h6gNrgjPPBYDIL0YNgIjb9UFShkmsof6Wv+ooeigK5IZ9OVgtEHD/L:64ErKPBMYNZXVkIiWvdJ5K5mZGn

Score
10/10
qakbottchk071702975817bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

tchk07

Campaign

1702975817

C2

116.203.56.11:443

109.107.181.8:443
Attributes
  • camp_date

    2023-12-19 08:50:17 +0000 UTC

Targets

    • Target

      e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115.msi

    • Size

      2.1MB

    • MD5

      723dae8ed3f157e40635681f028328e6

    • SHA1

      aa6dd8df02000fbfc884e687bcafed57f84a83b0

    • SHA256

      e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115

    • SHA512

      4e1829bfc470ea8624dee424db34b2b0f965597c1e300ca62f271727a7fd4dc6c90137d5ca8fd227ba3bad26fee2870788f91b00b225d6a626e99e18476473be

    • SSDEEP

      49152:DNGitd+vszAlozTy4g5r8+5eNBADPGXJXrejhJ8I+jELv6:oihTyfIXreNJ8IpT6

    Score
    10/10
    qakbottchk071702975817bankerstealertrojan

    • Detect Qakbot Payload

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks