qakbot | 89f295e3f67f0d1787dff3c18d74764fb354c09ad6ade10544577dfedc25e83d | Triage

Sharing

General

Target

0ed026cfd963a24441bcbb9a45a0c1cc_JaffaCakes118
Size

337KB
Sample

240625-vbld6a1frd
MD5

0ed026cfd963a24441bcbb9a45a0c1cc
SHA1

a0cba199ca7d9ac4286aa57341d238510b12bd46
SHA256

89f295e3f67f0d1787dff3c18d74764fb354c09ad6ade10544577dfedc25e83d
SHA512

0f14e8fdbb4c7ab7de0b0d4350a2ab65afe9f2ee64104b4a45d36f42a2dc98b9916204e93324077a8d97d238cafec788c975247f621dcfc9ec763e13029b9a0b
SSDEEP

6144:pgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyD2:7kvhhOKJETRByqTwr03pdfl

Score

10^/10

qakbot obama04 1613469138 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama04

Campaign

1613469138

C2

50.29.166.232:995

89.137.211.239:995

172.78.30.215:443

193.248.221.184:2222

80.227.5.69:443

216.201.162.158:443

75.67.192.125:443

105.96.8.96:443

77.211.30.202:995

136.232.34.70:443

87.202.87.210:2222

86.245.46.27:2222

90.101.117.122:2222

81.97.154.100:443

47.196.192.184:443

197.161.154.132:443

78.185.59.190:443

202.188.138.162:443

77.27.204.204:995

203.194.110.74:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  0ed026cfd963a24441bcbb9a45a0c1cc_JaffaCakes118
- Size
  
  337KB
- MD5
  
  0ed026cfd963a24441bcbb9a45a0c1cc
- SHA1
  
  a0cba199ca7d9ac4286aa57341d238510b12bd46
- SHA256
  
  89f295e3f67f0d1787dff3c18d74764fb354c09ad6ade10544577dfedc25e83d
- SHA512
  
  0f14e8fdbb4c7ab7de0b0d4350a2ab65afe9f2ee64104b4a45d36f42a2dc98b9916204e93324077a8d97d238cafec788c975247f621dcfc9ec763e13029b9a0b
- SSDEEP
  
  6144:pgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyD2:7kvhhOKJETRByqTwr03pdfl
Score

10^/10

qakbot obama04 1613469138 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

qakbotobama041613469138bankerstealertrojan

behavioral2

qakbotobama041613469138bankerstealertrojan