qakbot | 3ea5e97103739a7170ce72b9b0b1f046fafbdbe3e7c1faa54842d3f8f9a855c2 | Triage

Sharing

General

Target

cf2b81c824f5927d1ff64888d92c3c58_JaffaCakes118
Size

398KB
Sample

240906-kxp95axemj
MD5

cf2b81c824f5927d1ff64888d92c3c58
SHA1

2e6415d1721abafdcf5cb56254cdc196e30c5006
SHA256

3ea5e97103739a7170ce72b9b0b1f046fafbdbe3e7c1faa54842d3f8f9a855c2
SHA512

9ba506746ed8fb4d6288ce539eb1a10b24044327294a467cff16c52fa4487c61bef673c4691e1e9fc03022ea7a7c79bc0b0d7a04432a575b01121f05bcd6e1f4
SSDEEP

6144:V9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+c:j2wr03pdf8vhhOKJET8Byq+c

Score

10^/10

qakbot biden01 1613656969 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden01

Campaign

1613656969

C2

172.87.157.235:3389

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

197.45.110.165:995

86.160.137.132:443

86.236.77.68:2222

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

72.252.201.69:443

71.117.132.169:443

98.173.34.212:995

83.110.12.140:2222

95.77.223.148:443

41.39.134.183:443

85.52.72.32:2222

195.12.154.8:443

108.160.123.244:443

96.57.188.174:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  cf2b81c824f5927d1ff64888d92c3c58_JaffaCakes118
- Size
  
  398KB
- MD5
  
  cf2b81c824f5927d1ff64888d92c3c58
- SHA1
  
  2e6415d1721abafdcf5cb56254cdc196e30c5006
- SHA256
  
  3ea5e97103739a7170ce72b9b0b1f046fafbdbe3e7c1faa54842d3f8f9a855c2
- SHA512
  
  9ba506746ed8fb4d6288ce539eb1a10b24044327294a467cff16c52fa4487c61bef673c4691e1e9fc03022ea7a7c79bc0b0d7a04432a575b01121f05bcd6e1f4
- SSDEEP
  
  6144:V9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+c:j2wr03pdf8vhhOKJET8Byq+c
Score

10^/10

qakbot biden01 1613656969 banker discovery stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotbiden011613656969bankerdiscoverystealertrojan

behavioral2

qakbotbiden011613656969bankerdiscoverystealertrojan