qakbot | 555ee35ba23626324ce3962e08ebb04ebb0cfa6b2e325f712a3387e8c3e48f27 | Triage

Sharing

General

Target

c44c1f7a9ad11a0161df99d4e6e6f687_JaffaCakes118
Size

398KB
Sample

240827-eajk6stajp
MD5

c44c1f7a9ad11a0161df99d4e6e6f687
SHA1

f7499d001a41aaee64aed10efcb2fc836a77b167
SHA256

555ee35ba23626324ce3962e08ebb04ebb0cfa6b2e325f712a3387e8c3e48f27
SHA512

247d1113e421d418f7e317bd76742bfea7c00e0725374cd8f624671876406d4567505f755b5548f11cf85bd26d5c52fad6b15774158a12f1fa7931f3453dbbf5
SSDEEP

6144:l9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+B:z2wr03pdf8vhhOKJET8Byq+B

Score

10^/10

qakbot biden01 1613656969 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden01

Campaign

1613656969

C2

172.87.157.235:3389

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

197.45.110.165:995

86.160.137.132:443

86.236.77.68:2222

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

72.252.201.69:443

71.117.132.169:443

98.173.34.212:995

83.110.12.140:2222

95.77.223.148:443

41.39.134.183:443

85.52.72.32:2222

195.12.154.8:443

108.160.123.244:443

96.57.188.174:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  c44c1f7a9ad11a0161df99d4e6e6f687_JaffaCakes118
- Size
  
  398KB
- MD5
  
  c44c1f7a9ad11a0161df99d4e6e6f687
- SHA1
  
  f7499d001a41aaee64aed10efcb2fc836a77b167
- SHA256
  
  555ee35ba23626324ce3962e08ebb04ebb0cfa6b2e325f712a3387e8c3e48f27
- SHA512
  
  247d1113e421d418f7e317bd76742bfea7c00e0725374cd8f624671876406d4567505f755b5548f11cf85bd26d5c52fad6b15774158a12f1fa7931f3453dbbf5
- SSDEEP
  
  6144:l9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+B:z2wr03pdf8vhhOKJET8Byq+B
Score

10^/10

qakbot biden01 1613656969 banker discovery stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotbiden011613656969bankerdiscoverystealertrojan

behavioral2

qakbotbiden011613656969bankerdiscoverystealertrojan