qakbot | 124e21d7703c5c6180684f184752f50d78e12ab15dc18657c2e8f7fa70173af9 | Triage

Sharing

General

Target

124e21d7703c5c6180684f184752f50d78e12ab15dc18657c2e8f7fa70173af9.exe
Size

890KB
Sample

241123-efdxwatnhn
MD5

c5123472fea581386bb7836b3d74ad41
SHA1

fd70e66ca5dad0546d306dad9e4c94c8ff9f55e1
SHA256

124e21d7703c5c6180684f184752f50d78e12ab15dc18657c2e8f7fa70173af9
SHA512

30edec6c59881d793b39cbdcee831c424f5e9d8bd57c97723eda4958da93ffbd224a62a330625e1b94e6f95ccdcd7e0f4155448d15ebda4b230d1dc4927fc5d7
SSDEEP

24576:tvmCkl3miQH9ZfSCFEz8uViMKvb/o2ggJcWMeQRqgW:tvmr3m1jSCFMKvjjXJcF9qgW

Score

10^/10

qakbot biden54 1634810637 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634810637

C2

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  124e21d7703c5c6180684f184752f50d78e12ab15dc18657c2e8f7fa70173af9.exe
- Size
  
  890KB
- MD5
  
  c5123472fea581386bb7836b3d74ad41
- SHA1
  
  fd70e66ca5dad0546d306dad9e4c94c8ff9f55e1
- SHA256
  
  124e21d7703c5c6180684f184752f50d78e12ab15dc18657c2e8f7fa70173af9
- SHA512
  
  30edec6c59881d793b39cbdcee831c424f5e9d8bd57c97723eda4958da93ffbd224a62a330625e1b94e6f95ccdcd7e0f4155448d15ebda4b230d1dc4927fc5d7
- SSDEEP
  
  24576:tvmCkl3miQH9ZfSCFEz8uViMKvb/o2ggJcWMeQRqgW:tvmr3m1jSCFMKvjjXJcF9qgW
Score

10^/10

qakbot biden54 1634810637 banker discovery evasion stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotbiden541634810637bankerdiscoveryevasionstealertrojan

behavioral2

qakbotbiden541634810637bankerdiscoveryevasionstealertrojan