qakbot | cffd139605da08354ec82ae6acc030bef2ccef95879d98e71f3b9366cd65e6a9 | Triage

Sharing

General

Target

cffd139605da08354ec82ae6acc030bef2ccef95879d98e71f3b9366cd65e6a9.exe
Size

1.2MB
Sample

241121-agw3mawdrf
MD5

d8750f0357dffef6b450fc4068c715f8
SHA1

1ea42bb636b9f63cc50d7b90970fed7c832937fa
SHA256

cffd139605da08354ec82ae6acc030bef2ccef95879d98e71f3b9366cd65e6a9
SHA512

2c0f4816260df2f6e2c0cdd9c271cb1854c79162bbd116e62c3cf141d57fa540b6456171ad48017c32c48059fc5f53be15980afca366dfe55da851bd09330933
SSDEEP

24576:+zVwOlR/8qI8ixvTHv2AVpIP97+xgbZTek7XA:+zVjR/zI8ixHvzS97+xgbZTf7XA

Score

10^/10

qakbot biden53 1634717752 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden53

Campaign

1634717752

C2

103.142.10.177:443

24.152.219.253:995

181.118.183.94:443

129.208.147.188:995

24.119.214.7:443

38.70.253.226:2222

103.143.8.71:443

77.57.204.78:443

65.100.174.110:995

220.255.25.28:2222

91.178.126.51:995

37.210.155.239:995

81.241.252.59:2078

93.48.58.123:2222

65.100.174.110:443

76.25.142.196:443

24.231.209.2:2222

140.82.49.12:443

146.66.238.74:443

39.49.4.147:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  cffd139605da08354ec82ae6acc030bef2ccef95879d98e71f3b9366cd65e6a9.exe
- Size
  
  1.2MB
- MD5
  
  d8750f0357dffef6b450fc4068c715f8
- SHA1
  
  1ea42bb636b9f63cc50d7b90970fed7c832937fa
- SHA256
  
  cffd139605da08354ec82ae6acc030bef2ccef95879d98e71f3b9366cd65e6a9
- SHA512
  
  2c0f4816260df2f6e2c0cdd9c271cb1854c79162bbd116e62c3cf141d57fa540b6456171ad48017c32c48059fc5f53be15980afca366dfe55da851bd09330933
- SSDEEP
  
  24576:+zVwOlR/8qI8ixvTHv2AVpIP97+xgbZTek7XA:+zVjR/zI8ixHvzS97+xgbZTf7XA
Score

10^/10

qakbot biden53 1634717752 banker discovery evasion stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotbiden531634717752bankerdiscoveryevasionstealertrojan

behavioral2

qakbotbiden531634717752bankerdiscoveryevasionstealertrojan