Overview

overview

10

Static

static

3

727e896dcd...0N.exe

windows7-x64

10

727e896dcd...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    727e896dcd4e9f17d17a91f98550e8c0N.exe

  • Size

    1.1MB

  • Sample

    240821-rqsv1atbnd

  • MD5

    727e896dcd4e9f17d17a91f98550e8c0

  • SHA1

    586edcc9502f85b36b06ed09d1c2e246fcfc10a2

  • SHA256

    e1c61ff005c2607e11de4f2f547fb6c0a816e3c9f9e383936ca923d9c779bcdb

  • SHA512

    1054dae953fd845560383764dbaa6e83fac70ff090274ea1ab51fea1683403ec5cb7f6c1b89343be1278c4bf73d2c953fe56f28a4624d41fe891d5bcd69717e1

  • SSDEEP

    6144:0ZpTc6Ht8DkIfRD83d3kFICdy20svNbD58Z31EyIEgflxktjKkEGInR+HlZzmP6f:0ZhqDkcONxn20SNuKJPUhulLhJ9FCeI

Score
10/10
qakbotabc0201602752985bankerdiscoverystealertrojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc020

Campaign

1602752985

C2

2.89.121.99:995

89.42.142.35:443

81.133.234.36:2222

71.163.222.203:443

75.136.40.155:443

93.149.253.201:2222

71.187.170.235:443

185.19.190.81:443

196.221.61.242:443

72.28.255.159:995

45.32.162.253:443

45.32.155.12:443

45.32.155.12:2222

199.247.16.80:443

134.0.196.46:995

24.27.82.216:2222

117.218.208.239:443

68.225.60.77:443

217.162.149.212:443

71.19.217.23:443

Targets

    • Target

      727e896dcd4e9f17d17a91f98550e8c0N.exe

    • Size

      1.1MB

    • MD5

      727e896dcd4e9f17d17a91f98550e8c0

    • SHA1

      586edcc9502f85b36b06ed09d1c2e246fcfc10a2

    • SHA256

      e1c61ff005c2607e11de4f2f547fb6c0a816e3c9f9e383936ca923d9c779bcdb

    • SHA512

      1054dae953fd845560383764dbaa6e83fac70ff090274ea1ab51fea1683403ec5cb7f6c1b89343be1278c4bf73d2c953fe56f28a4624d41fe891d5bcd69717e1

    • SSDEEP

      6144:0ZpTc6Ht8DkIfRD83d3kFICdy20svNbD58Z31EyIEgflxktjKkEGInR+HlZzmP6f:0ZhqDkcONxn20SNuKJPUhulLhJ9FCeI

    Score
    10/10
    qakbotabc0201602752985bankerdiscoverystealertrojan

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks