qakbot | 146a74dfa467bb299b8e6719526f224e7643fb4c9da53d8adc1149471184f9d0 | Triage

Sharing

General

Target

130c22a54ee0e43dcc38a14409f75aae_JaffaCakes118
Size

4.0MB
Sample

240504-rc3haafh61
MD5

130c22a54ee0e43dcc38a14409f75aae
SHA1

2b20ef3eac7a375dc45ca0bf4f4670008d819562
SHA256

146a74dfa467bb299b8e6719526f224e7643fb4c9da53d8adc1149471184f9d0
SHA512

b0fda93ea1bfb867cfb3546555880414f15dcf3b8000c9a4ca8531acee0553b4b648b746c2cb53732519ea7b31213cc04e8e5850d77aed9e19be99ef2b8014e8
SSDEEP

6144:gI9ZZLBFFRt4T8vvVxa9m2xc440m7klZtHd8BH3HUILWgER:gItDt4T8za9mgvt98BXHUIL6R

Score

10^/10

qakbot tr01 1596554163 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.14

Botnet

tr01

Campaign

1596554163

C2

94.59.241.189:2222

86.98.66.175:2222

94.96.84.73:993

71.83.16.211:443

24.110.96.149:443

78.96.199.79:443

216.201.162.158:443

68.60.221.169:465

95.76.109.181:443

189.231.175.46:443

70.164.37.205:995

108.27.217.44:443

71.220.191.200:443

92.59.35.196:2222

71.192.44.92:443

108.30.125.94:443

93.151.180.170:61202

189.130.26.216:443

47.146.32.175:443

24.71.28.247:443

Targets

- Target
  
  130c22a54ee0e43dcc38a14409f75aae_JaffaCakes118
- Size
  
  4.0MB
- MD5
  
  130c22a54ee0e43dcc38a14409f75aae
- SHA1
  
  2b20ef3eac7a375dc45ca0bf4f4670008d819562
- SHA256
  
  146a74dfa467bb299b8e6719526f224e7643fb4c9da53d8adc1149471184f9d0
- SHA512
  
  b0fda93ea1bfb867cfb3546555880414f15dcf3b8000c9a4ca8531acee0553b4b648b746c2cb53732519ea7b31213cc04e8e5850d77aed9e19be99ef2b8014e8
- SSDEEP
  
  6144:gI9ZZLBFFRt4T8vvVxa9m2xc440m7klZtHd8BH3HUILWgER:gItDt4T8za9mgvt98BXHUIL6R
Score

10^/10

qakbot tr01 1596554163 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

qakbottr011596554163bankerstealertrojan

behavioral2

qakbottr011596554163bankerstealertrojan