Overview

overview

10

Static

static

1

maldoc_5.msi

windows7-x64

10

maldoc_5.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    maldoc_5

  • Size

    2.1MB

  • Sample

    240909-3jgd6swcjr

  • MD5

    723dae8ed3f157e40635681f028328e6

  • SHA1

    aa6dd8df02000fbfc884e687bcafed57f84a83b0

  • SHA256

    e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115

  • SHA512

    4e1829bfc470ea8624dee424db34b2b0f965597c1e300ca62f271727a7fd4dc6c90137d5ca8fd227ba3bad26fee2870788f91b00b225d6a626e99e18476473be

  • SSDEEP

    49152:DNGitd+vszAlozTy4g5r8+5eNBADPGXJXrejhJ8I+jELv6:oihTyfIXreNJ8IpT6

Score
10/10
qakbottchk071702975817bankerdiscoverypersistenceprivilege_escalationstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

tchk07

Campaign

1702975817

C2

116.203.56.11:443

109.107.181.8:443
Attributes
  • camp_date

    2023-12-19 08:50:17 +0000 UTC

Targets

    • Target

      maldoc_5

    • Size

      2.1MB

    • MD5

      723dae8ed3f157e40635681f028328e6

    • SHA1

      aa6dd8df02000fbfc884e687bcafed57f84a83b0

    • SHA256

      e88610db05636a1476435ec1f39d3651b080c8a6b8756452d421d7a822a2e115

    • SHA512

      4e1829bfc470ea8624dee424db34b2b0f965597c1e300ca62f271727a7fd4dc6c90137d5ca8fd227ba3bad26fee2870788f91b00b225d6a626e99e18476473be

    • SSDEEP

      49152:DNGitd+vszAlozTy4g5r8+5eNBADPGXJXrejhJ8I+jELv6:oihTyfIXreNJ8IpT6

    Score
    10/10
    qakbottchk071702975817bankerdiscoverypersistenceprivilege_escalationstealertrojan

    • Detect Qakbot Payload

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks