qakbot | 929266c5f7930996ec26e09f1d163ea356946cd4eed12523e2606b33448b8fbf | Triage

Sharing

General

Target

929266c5f7930996ec26e09f1d163ea356946cd4eed12523e2606b33448b8fbf.exe
Size

1.6MB
Sample

241120-3pyweawgrn
MD5

1c399b307dc2464ace2fe06e227171c9
SHA1

073d37ed9ee2a7f2090118925785636dbaf1cb6c
SHA256

929266c5f7930996ec26e09f1d163ea356946cd4eed12523e2606b33448b8fbf
SHA512

64fa64b1e9fbaf67e0f54375bd0236b5338ed5fe4bea7a89123fdfe452084bd663f4085ad3e01d3c982ad20b6cf6cd08212f4adfc4a8a5be65784bab10f3250a
SSDEEP

24576:g9mB+XxJ7zUqNS8K6Cx2ffNrC0O60+bPzTk1wK7TpKsBX:gUBav7zbS8JCx2fftCv6JLwJ7FKsBX

Score

10^/10

qakbot tr 1634541613 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  929266c5f7930996ec26e09f1d163ea356946cd4eed12523e2606b33448b8fbf.exe
- Size
  
  1.6MB
- MD5
  
  1c399b307dc2464ace2fe06e227171c9
- SHA1
  
  073d37ed9ee2a7f2090118925785636dbaf1cb6c
- SHA256
  
  929266c5f7930996ec26e09f1d163ea356946cd4eed12523e2606b33448b8fbf
- SHA512
  
  64fa64b1e9fbaf67e0f54375bd0236b5338ed5fe4bea7a89123fdfe452084bd663f4085ad3e01d3c982ad20b6cf6cd08212f4adfc4a8a5be65784bab10f3250a
- SSDEEP
  
  24576:g9mB+XxJ7zUqNS8K6Cx2ffNrC0O60+bPzTk1wK7TpKsBX:gUBav7zbS8JCx2fftCv6JLwJ7FKsBX
Score

10^/10

qakbot tr 1634541613 banker discovery stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbottr1634541613bankerdiscoverystealertrojan

behavioral2

qakbottr1634541613bankerdiscoverystealertrojan