Overview

overview

10

Static

static

10

payload.exe

windows7-x64

10

payload.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payload.exe

  • Size

    203KB

  • Sample

    240626-vefyvawekn

  • MD5

    58c8c22e91018f44225a304155ca4e6d

  • SHA1

    3cd30cbb04dbf56ae648b2e1372fd28e5999a01b

  • SHA256

    d20b23f825b578b8eb266dce9bc9d89c1aaa38ea972924e59b599fe4fac4d3b9

  • SHA512

    6d27198431e1481dbb42602bb7869d15e2a8d06d4274bfe4c8a4b5ea125afe03cb2bf7c1ad0254a77e5b0e201c1aad3755dbd956484c355542a43fb9843bcd91

  • SSDEEP

    6144:XwthojqrStgEcMMtoJxtwyDuVWajrZX7lMFKUq:XwEIicpSJopw8

Score
10/10
qakbotspx1561597661994bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

spx156

Campaign

1597661994

C2

98.26.50.62:995

46.53.40.244:443

86.98.89.40:2222

108.30.125.94:443

189.130.26.216:443

96.37.113.36:993

216.201.162.158:443

24.37.178.158:443

73.228.1.246:443

175.111.128.234:443

95.77.144.238:443

41.36.58.89:995

84.247.55.190:443

66.215.32.224:443

67.6.3.51:443

197.37.219.90:993

144.202.48.107:443

49.191.130.48:443

73.214.248.17:995

24.44.142.213:2222

Targets

    • Target

      payload.exe

    • Size

      203KB

    • MD5

      58c8c22e91018f44225a304155ca4e6d

    • SHA1

      3cd30cbb04dbf56ae648b2e1372fd28e5999a01b

    • SHA256

      d20b23f825b578b8eb266dce9bc9d89c1aaa38ea972924e59b599fe4fac4d3b9

    • SHA512

      6d27198431e1481dbb42602bb7869d15e2a8d06d4274bfe4c8a4b5ea125afe03cb2bf7c1ad0254a77e5b0e201c1aad3755dbd956484c355542a43fb9843bcd91

    • SSDEEP

      6144:XwthojqrStgEcMMtoJxtwyDuVWajrZX7lMFKUq:XwEIicpSJopw8

    Score
    10/10
    qakbotspx1561597661994bankerstealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks