qakbot | 302f95f5c95cc01f5c4ba89c3ebffa17defcfb32ede12ba01ea6424b816a8377 | Triage

Sharing

General

Target

302f95f5c95cc01f5c4ba89c3ebffa17defcfb32ede12ba01ea6424b816a8377.exe
Size

572KB
Sample

241123-c3l6nawmbz
MD5

35e1af7cbecd2962fc198fad91be653f
SHA1

116cb22d295a36b857ad7883462ef6a77467822c
SHA256

302f95f5c95cc01f5c4ba89c3ebffa17defcfb32ede12ba01ea6424b816a8377
SHA512

4be95eb0553cb968c2ee01a5c7bd25e501787a84244b799602092639297f88fa01532a1a1c290f7d9766d2af4f81247388d5a2ccc86bb27cca61a59633b3fe6d
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHdM:VvAfLfaEkAz5SM

Score

10^/10

qakbot obama114 1634112211 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  302f95f5c95cc01f5c4ba89c3ebffa17defcfb32ede12ba01ea6424b816a8377.exe
- Size
  
  572KB
- MD5
  
  35e1af7cbecd2962fc198fad91be653f
- SHA1
  
  116cb22d295a36b857ad7883462ef6a77467822c
- SHA256
  
  302f95f5c95cc01f5c4ba89c3ebffa17defcfb32ede12ba01ea6424b816a8377
- SHA512
  
  4be95eb0553cb968c2ee01a5c7bd25e501787a84244b799602092639297f88fa01532a1a1c290f7d9766d2af4f81247388d5a2ccc86bb27cca61a59633b3fe6d
- SSDEEP
  
  6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHdM:VvAfLfaEkAz5SM
Score

10^/10

qakbot obama114 1634112211 banker discovery evasion stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotobama1141634112211bankerdiscoveryevasionstealertrojan

behavioral2

qakbotobama1141634112211bankerdiscoveryevasionstealertrojan