qakbot | 75a63acdb8a33ed9fe8ea41c4b687211990cacef35c296a3c6add7a0a542fcc0 | Triage

Sharing

General

Target

f7d7ea33c29b924c5e602449b4393f45_JaffaCakes118
Size

398KB
Sample

240926-h2t3rsthkq
MD5

f7d7ea33c29b924c5e602449b4393f45
SHA1

7dc2fb2440916bcd61e1eb05f0b45bfe21bc85ac
SHA256

75a63acdb8a33ed9fe8ea41c4b687211990cacef35c296a3c6add7a0a542fcc0
SHA512

cb0ec919e01f15aa8a5ae181b4457a36c8415a331a814a157db6495faeb7858800258e5aa9ad69fdb1ddc0ead50cc2fef6e5d9087602472caf57402329f694f6
SSDEEP

6144:z9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+6:B2wr03pdf8vhhOKJET8Byq+6

Score

10^/10

qakbot biden01 1613656969 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden01

Campaign

1613656969

C2

172.87.157.235:3389

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

197.45.110.165:995

86.160.137.132:443

86.236.77.68:2222

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

72.252.201.69:443

71.117.132.169:443

98.173.34.212:995

83.110.12.140:2222

95.77.223.148:443

41.39.134.183:443

85.52.72.32:2222

195.12.154.8:443

108.160.123.244:443

96.57.188.174:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  f7d7ea33c29b924c5e602449b4393f45_JaffaCakes118
- Size
  
  398KB
- MD5
  
  f7d7ea33c29b924c5e602449b4393f45
- SHA1
  
  7dc2fb2440916bcd61e1eb05f0b45bfe21bc85ac
- SHA256
  
  75a63acdb8a33ed9fe8ea41c4b687211990cacef35c296a3c6add7a0a542fcc0
- SHA512
  
  cb0ec919e01f15aa8a5ae181b4457a36c8415a331a814a157db6495faeb7858800258e5aa9ad69fdb1ddc0ead50cc2fef6e5d9087602472caf57402329f694f6
- SSDEEP
  
  6144:z9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+6:B2wr03pdf8vhhOKJET8Byq+6
Score

10^/10

qakbot biden01 1613656969 banker discovery stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotbiden011613656969bankerdiscoverystealertrojan

behavioral2

qakbotbiden011613656969bankerdiscoverystealertrojan