qakbot | 38f3fd386e1cfcfb95ce2fc8051d1f41734b45806b78e993ecfa5f1f0728d6fb | Triage

Sharing

General

Target

38f3fd386e1cfcfb95ce2fc8051d1f41734b45806b78e993ecfa5f1f0728d6fb
Size

745KB
Sample

241015-zf8sgawckc
MD5

5301ff40cb10c58044e258b3816cafc9
SHA1

84c6aca946081ce7b4186fefd2c684424ccd0198
SHA256

38f3fd386e1cfcfb95ce2fc8051d1f41734b45806b78e993ecfa5f1f0728d6fb
SHA512

9caf882e6bb328e8301b8605ca0cd9e8222abaa84ea3106d05d9c8c562f7b92d140a7ba39774eb5678b14e3101a026ec2e4a3df1242e566c972d70576fba53c2
SSDEEP

12288:LufPALI5y6pIa5qS9l8PVVCJGivDV+LOk+vS0jwQb0mpdBpr+uGNYTRuLiNrAsoS:LuHALK35/c9VYGca0jwFmpFRTRueNchS

Score

10^/10

qakbot tr 1635152597 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1635152597

C2

120.150.218.241:995

143.92.137.106:443

41.43.196.111:443

196.207.140.40:995

136.143.11.232:443

39.49.45.250:995

87.109.246.232:995

96.246.158.154:995

216.201.162.158:443

45.9.20.200:443

197.89.144.19:443

37.208.162.27:443

207.246.112.221:443

189.252.140.141:32101

96.21.251.127:2222

103.143.8.71:443

115.99.227.13:995

73.25.109.183:2222

182.176.180.73:443

2.222.167.138:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  38f3fd386e1cfcfb95ce2fc8051d1f41734b45806b78e993ecfa5f1f0728d6fb
- Size
  
  745KB
- MD5
  
  5301ff40cb10c58044e258b3816cafc9
- SHA1
  
  84c6aca946081ce7b4186fefd2c684424ccd0198
- SHA256
  
  38f3fd386e1cfcfb95ce2fc8051d1f41734b45806b78e993ecfa5f1f0728d6fb
- SHA512
  
  9caf882e6bb328e8301b8605ca0cd9e8222abaa84ea3106d05d9c8c562f7b92d140a7ba39774eb5678b14e3101a026ec2e4a3df1242e566c972d70576fba53c2
- SSDEEP
  
  12288:LufPALI5y6pIa5qS9l8PVVCJGivDV+LOk+vS0jwQb0mpdBpr+uGNYTRuLiNrAsoS:LuHALK35/c9VYGca0jwFmpFRTRueNchS
Score

10^/10

qakbot tr 1635152597 banker discovery evasion stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbottr1635152597bankerdiscoveryevasionstealertrojan

behavioral2

qakbottr1635152597bankerdiscoveryevasionstealertrojan