qakbot | 4754a5c9610519b9eddf7768158b89c2b9f65fcbf101db3a8a8408d1c3ed101f | Triage

Sharing

General

Target

39e805042e9ac176f16a079f55d15b5c_JaffaCakes118
Size

253KB
Sample

241012-n8kessterk
MD5

39e805042e9ac176f16a079f55d15b5c
SHA1

7eb23c62e8e1886905282a067300e9828d97975c
SHA256

4754a5c9610519b9eddf7768158b89c2b9f65fcbf101db3a8a8408d1c3ed101f
SHA512

ed7e60e3205b6a8f51095ef808aa71ad188e18b2c5b84a033e970e7bd8c0e065a551b02ea529dd9a1fa9e23a0fd491aebbdb54c0f5aaf53f72560747b6b0ba66
SSDEEP

3072:0PQdEOItJPxluIalXQOr+nxQNBO0jTL23i7eBnaVImWeqSR4G78SYSuDSMv6UWN:MUr+nxQNBO0jf2Ee5aSzeF4DSY7Dh6f

Score

10^/10

qakbot obama105 1632819007 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama105

Campaign

1632819007

C2

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

75.66.88.33:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  39e805042e9ac176f16a079f55d15b5c_JaffaCakes118
- Size
  
  253KB
- MD5
  
  39e805042e9ac176f16a079f55d15b5c
- SHA1
  
  7eb23c62e8e1886905282a067300e9828d97975c
- SHA256
  
  4754a5c9610519b9eddf7768158b89c2b9f65fcbf101db3a8a8408d1c3ed101f
- SHA512
  
  ed7e60e3205b6a8f51095ef808aa71ad188e18b2c5b84a033e970e7bd8c0e065a551b02ea529dd9a1fa9e23a0fd491aebbdb54c0f5aaf53f72560747b6b0ba66
- SSDEEP
  
  3072:0PQdEOItJPxluIalXQOr+nxQNBO0jTL23i7eBnaVImWeqSR4G78SYSuDSMv6UWN:MUr+nxQNBO0jf2Ee5aSzeF4DSY7Dh6f
Score

10^/10

qakbot obama105 1632819007 banker discovery evasion stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotobama1051632819007bankerdiscoveryevasionstealertrojan

behavioral2

qakbotobama1051632819007bankerdiscoveryevasionstealertrojan