qakbot | 28187610a1ea319d44533801b67984760412fe2cd8ef6131f29033672fb3cf53 | Triage

Sharing

General

Target

5094dcd3f4bd829b649da8d4a57e9908_JaffaCakes118
Size

337KB
Sample

240716-3sn6dawdkj
MD5

5094dcd3f4bd829b649da8d4a57e9908
SHA1

2dd1f90acf33489dda9edeaf4bea42b8eb3b5415
SHA256

28187610a1ea319d44533801b67984760412fe2cd8ef6131f29033672fb3cf53
SHA512

55944df4d3b86996f57c9c5f8164da645b10d1ec299bcfcd1b53bd0e0b1a9fd1951205ec940dbc73bda0f73898b754ab00c291023f97c6df3640926bfc61e860
SSDEEP

6144:kgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyDz:SkvhhOKJETRByqTwr03pdf4

Score

10^/10

qakbot obama04 1613469138 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama04

Campaign

1613469138

C2

50.29.166.232:995

89.137.211.239:995

172.78.30.215:443

193.248.221.184:2222

80.227.5.69:443

216.201.162.158:443

75.67.192.125:443

105.96.8.96:443

77.211.30.202:995

136.232.34.70:443

87.202.87.210:2222

86.245.46.27:2222

90.101.117.122:2222

81.97.154.100:443

47.196.192.184:443

197.161.154.132:443

78.185.59.190:443

202.188.138.162:443

77.27.204.204:995

203.194.110.74:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  5094dcd3f4bd829b649da8d4a57e9908_JaffaCakes118
- Size
  
  337KB
- MD5
  
  5094dcd3f4bd829b649da8d4a57e9908
- SHA1
  
  2dd1f90acf33489dda9edeaf4bea42b8eb3b5415
- SHA256
  
  28187610a1ea319d44533801b67984760412fe2cd8ef6131f29033672fb3cf53
- SHA512
  
  55944df4d3b86996f57c9c5f8164da645b10d1ec299bcfcd1b53bd0e0b1a9fd1951205ec940dbc73bda0f73898b754ab00c291023f97c6df3640926bfc61e860
- SSDEEP
  
  6144:kgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyDz:SkvhhOKJETRByqTwr03pdf4
Score

10^/10

qakbot obama04 1613469138 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

qakbotobama041613469138bankerstealertrojan

behavioral2

qakbotobama041613469138bankerstealertrojan