qakbot | df85f6d9b7786ff3ea72e3b8e465cee77ebd9c15f21851474f39ae64c28500e8 | Triage

Sharing

General

Target

031e1ad22f8c675be5213f00e413b389_JaffaCakes118
Size

398KB
Sample

240622-vtrnwszgpk
MD5

031e1ad22f8c675be5213f00e413b389
SHA1

8036bf0cd96df59f747bdbff91e1450aa4fa471c
SHA256

df85f6d9b7786ff3ea72e3b8e465cee77ebd9c15f21851474f39ae64c28500e8
SHA512

5fde8557854c6ac816e1a9c0c834575df6471b6c1d11da3958b1db5422995a48522308c406b7d6e16816ab09f6a0d4a52d39adc7d2a8a91132c61bb0a5a4013e
SSDEEP

6144:79ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK++:Z2wr03pdf8vhhOKJET8Byq++

Score

10^/10

qakbot biden01 1613656969 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden01

Campaign

1613656969

C2

172.87.157.235:3389

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

197.45.110.165:995

86.160.137.132:443

86.236.77.68:2222

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

72.252.201.69:443

71.117.132.169:443

98.173.34.212:995

83.110.12.140:2222

95.77.223.148:443

41.39.134.183:443

85.52.72.32:2222

195.12.154.8:443

108.160.123.244:443

96.57.188.174:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  031e1ad22f8c675be5213f00e413b389_JaffaCakes118
- Size
  
  398KB
- MD5
  
  031e1ad22f8c675be5213f00e413b389
- SHA1
  
  8036bf0cd96df59f747bdbff91e1450aa4fa471c
- SHA256
  
  df85f6d9b7786ff3ea72e3b8e465cee77ebd9c15f21851474f39ae64c28500e8
- SHA512
  
  5fde8557854c6ac816e1a9c0c834575df6471b6c1d11da3958b1db5422995a48522308c406b7d6e16816ab09f6a0d4a52d39adc7d2a8a91132c61bb0a5a4013e
- SSDEEP
  
  6144:79ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK++:Z2wr03pdf8vhhOKJET8Byq++
Score

10^/10

qakbot biden01 1613656969 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

qakbotbiden011613656969bankerstealertrojan

behavioral2

qakbotbiden011613656969bankerstealertrojan