qakbot | 05701d95a1c429a2ef8fe2bf6acfff46a2e003f001e10631f53ed90458a3b0b7 | Triage

Sharing

General

Target

7adaaa67295ca4e2006ab02d76043bb0_JaffaCakes118
Size

402KB
Sample

240731-cd1yhsvfmc
MD5

7adaaa67295ca4e2006ab02d76043bb0
SHA1

0d939a5748600d0ac2c6048cc7a4f5e28aeab521
SHA256

05701d95a1c429a2ef8fe2bf6acfff46a2e003f001e10631f53ed90458a3b0b7
SHA512

962d4c8e67e200a9ebad9ef672395286c19930db0f3faffdbd365945082ca5e9c85b97ea63cdf13e16efb8a5999c84b8239323c59181cf9ed01083f9d038639d
SSDEEP

6144:JyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm:tTwr03pdf8vhhOKJET5By

Score

10^/10

qakbot obama05 1613729859 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama05

Campaign

1613729859

C2

86.160.137.132:443

172.87.157.235:3389

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

188.25.63.105:443

71.117.132.169:443

193.248.221.184:2222

85.52.72.32:2222

87.202.87.210:2222

78.185.59.190:443

2.7.116.188:2222

81.97.154.100:443

24.50.118.93:443

98.121.187.78:443

108.29.32.251:443

24.152.219.253:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  7adaaa67295ca4e2006ab02d76043bb0_JaffaCakes118
- Size
  
  402KB
- MD5
  
  7adaaa67295ca4e2006ab02d76043bb0
- SHA1
  
  0d939a5748600d0ac2c6048cc7a4f5e28aeab521
- SHA256
  
  05701d95a1c429a2ef8fe2bf6acfff46a2e003f001e10631f53ed90458a3b0b7
- SHA512
  
  962d4c8e67e200a9ebad9ef672395286c19930db0f3faffdbd365945082ca5e9c85b97ea63cdf13e16efb8a5999c84b8239323c59181cf9ed01083f9d038639d
- SSDEEP
  
  6144:JyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm:tTwr03pdf8vhhOKJET5By
Score

10^/10

qakbot obama05 1613729859 banker discovery stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotobama051613729859bankerdiscoverystealertrojan

behavioral2

qakbotobama051613729859bankerdiscoverystealertrojan