qakbot | 6ca1498b43435ae08ce08a4cffce0fcfe660bdd907a48eda0dc7a663f4c971a7 | Triage

Sharing

General

Target

6dcf8baea04fda87a96b3a137ea4dbfc_JaffaCakes118
Size

136KB
Sample

241023-js6wms1brj
MD5

6dcf8baea04fda87a96b3a137ea4dbfc
SHA1

19ed57597ebb7649e76076c1531f2d665b551435
SHA256

6ca1498b43435ae08ce08a4cffce0fcfe660bdd907a48eda0dc7a663f4c971a7
SHA512

33e252f7a262d1c7d6fb0d1792381a9295a0d81ff9191298989f1e01de9d7d3d560804131abd1d265618b46254d2fae18e7c8e8cc6f7efcc36880571beb2b2eb
SSDEEP

1536:AKQJDzynl8pck/VxhNRjJrBbQ2oTPycJFtNmQ/IOEnToIfwTToqMV29ic:jnl1kNxhN1J9c2oTzJHNfxoTBfwEVA

Score

10^/10

qakbot tr 1632817399 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  6dcf8baea04fda87a96b3a137ea4dbfc_JaffaCakes118
- Size
  
  136KB
- MD5
  
  6dcf8baea04fda87a96b3a137ea4dbfc
- SHA1
  
  19ed57597ebb7649e76076c1531f2d665b551435
- SHA256
  
  6ca1498b43435ae08ce08a4cffce0fcfe660bdd907a48eda0dc7a663f4c971a7
- SHA512
  
  33e252f7a262d1c7d6fb0d1792381a9295a0d81ff9191298989f1e01de9d7d3d560804131abd1d265618b46254d2fae18e7c8e8cc6f7efcc36880571beb2b2eb
- SSDEEP
  
  1536:AKQJDzynl8pck/VxhNRjJrBbQ2oTPycJFtNmQ/IOEnToIfwTToqMV29ic:jnl1kNxhN1J9c2oTzJHNfxoTBfwEVA
Score

10^/10

qakbot tr 1632817399 banker discovery evasion stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

tr1632817399qakbot

behavioral1

qakbottr1632817399bankerdiscoveryevasionstealertrojan

behavioral2

qakbottr1632817399bankerdiscoveryevasionstealertrojan