qakbot | 047ca8140f4309e1168a26de0fc04ab07d3ecae155c9c70c3cfa8bf7cdc1471e | Triage

Sharing

General

Target

17f776331866aa558d9526edfa8d23a8_JaffaCakes118
Size

337KB
Sample

240627-3m4c4s1fmk
MD5

17f776331866aa558d9526edfa8d23a8
SHA1

0be8e4d452b00aae2c19bced7a6ed9d9dc99b1f2
SHA256

047ca8140f4309e1168a26de0fc04ab07d3ecae155c9c70c3cfa8bf7cdc1471e
SHA512

a77dde4f6586bd3c1bb0a5af855faaa83958f6f5f35da93f411b6e2a317fa9047c2d987d1eb7ee48af4965aa671b740a48411a2bc05c940a6b8af81a641df4cd
SSDEEP

6144:KgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyD5:ckvhhOKJETRByqTwr03pdf6

Score

10^/10

qakbot obama04 1613469138 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama04

Campaign

1613469138

C2

50.29.166.232:995

89.137.211.239:995

172.78.30.215:443

193.248.221.184:2222

80.227.5.69:443

216.201.162.158:443

75.67.192.125:443

105.96.8.96:443

77.211.30.202:995

136.232.34.70:443

87.202.87.210:2222

86.245.46.27:2222

90.101.117.122:2222

81.97.154.100:443

47.196.192.184:443

197.161.154.132:443

78.185.59.190:443

202.188.138.162:443

77.27.204.204:995

203.194.110.74:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  17f776331866aa558d9526edfa8d23a8_JaffaCakes118
- Size
  
  337KB
- MD5
  
  17f776331866aa558d9526edfa8d23a8
- SHA1
  
  0be8e4d452b00aae2c19bced7a6ed9d9dc99b1f2
- SHA256
  
  047ca8140f4309e1168a26de0fc04ab07d3ecae155c9c70c3cfa8bf7cdc1471e
- SHA512
  
  a77dde4f6586bd3c1bb0a5af855faaa83958f6f5f35da93f411b6e2a317fa9047c2d987d1eb7ee48af4965aa671b740a48411a2bc05c940a6b8af81a641df4cd
- SSDEEP
  
  6144:KgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyD5:ckvhhOKJETRByqTwr03pdf6
Score

10^/10

qakbot obama04 1613469138 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

qakbotobama041613469138bankerstealertrojan

behavioral2

qakbotobama041613469138bankerstealertrojan