qakbot | 951cc98b54bc4d78ce4f11a3bdbfdaee7777591ffef88bb2557ebecbb1909013

General

Target

951cc98b54bc4d78ce4f11a3bdbfdaee7777591ffef88bb2557ebecbb1909013.iso
Size

446KB
Sample

240614-b2frtatgkn
MD5

1a5d350d71f6821006691ac076e026e0
SHA1

1dfb04e5d3f71b03085b3787e4970281f08bff74
SHA256

951cc98b54bc4d78ce4f11a3bdbfdaee7777591ffef88bb2557ebecbb1909013
SHA512

191ffda025f43e4133cd9bd941304adb2057c557cecab95207a02a117c57533c0713233f8701965f9699da2c891a97c6f26f55e9b9c11accfc0eaa11f3dc753c
SSDEEP

6144:etgTFlqteWTBa5WsoUReNsyLK9d8WqniKS9jyA9yjHHXsBcfmL/p+LIORL6qYFYM:U8z4TU5WsoURzN9WtniPHlQEFYM

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.914

Botnet

obama210

Campaign

1665041236

C2

41.104.205.128:443

134.35.6.76:443

197.202.163.4:443

181.164.194.228:443

105.159.124.224:443

197.158.89.85:443

41.96.33.236:443

181.141.3.126:443

123.22.7.132:443

163.182.177.80:443

41.248.72.229:8443

41.100.62.129:443

68.83.169.91:443

190.29.228.61:443

160.176.249.11:995

41.107.54.99:443

94.52.127.44:443

105.69.155.85:995

45.227.251.167:2222

197.206.141.97:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  
  6438/8157.cmd
- Size
  
  275B
- MD5
  
  533d29a067a011b9115e4fcbc94305d7
- SHA1
  
  1ff3aa4f90e4933ebfe20e1398dc22ecf8a2e771
- SHA256
  
  7bad03aef5b3d3c66dd5a4ed8a82d18643e90536b963e0711611e3266f24d054
- SHA512
  
  01d8fc83062dd83e15d3345e2463c6161c052e50a9cfe416de0f7ed569cc02cd63c091f5537ad0ceedf7414cad74ccbd96ab732587b873dd7152c6faadaf5d00
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  6438/plugged.dat
- Size
  
  386KB
- MD5
  
  88f2abefd23b14fc8691710eccfb27a8
- SHA1
  
  9b06af24a62d2760dbddc2ee7be531796c8552f8
- SHA256
  
  7bf94324bf7ffd68800911283340439b03bcdbf5a97d45daed22f84b4f9883eb
- SHA512
  
  3d65448493d8db946a30e129af0792a88d3093c544ec5b98118ff09b854055caa7558f12f334b0c350605c9a44fcf837992025ced5bdfea5657230ac2d165286
- SSDEEP
  
  6144:XtgTFlqteWTBa5WsoUReNsyLK9d8WqniKS9jyA9yjHHXsBcfmL/p+LIORL6qYFYM:d8z4TU5WsoURzN9WtniPHlQEFYM
Score

10^/10

qakbot obama210 1665041236 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral3 behavioral4
- Target
  
  Overdue.lnk
- Size
  
  1KB
- MD5
  
  62ba90eccd4951f50c79d95a479bfb4e
- SHA1
  
  c98c5354e1d76a80183f296f76fa8868fa375d90
- SHA256
  
  597dce062ac3a05e9d839bb7da4e70862d30ec7982a06fb219093a75018c1080
- SHA512
  
  e733ae6b7a6971f72c49115f75e8e93bc214ae840dc68e0f5022322eba1c4fc2f9e4c274a703b55ae05035512c06ae8abfc2465fb603904678abb2ec51043576
Score

3^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Loads dropped DLL

Qakbot/Qbot

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6