qakbot | 76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421 | Triage

Sharing

General

Target

76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421.exe
Size

512KB
Sample

241123-jweass1pbx
MD5

ac2cec3f240393f9015b7c6754bdef59
SHA1

36c5790aae838a0fc04f81da8c364bdb04208707
SHA256

76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421
SHA512

3447a336e0b2e8206e77d874abc9b0c2d01c5ea87172b25b707d90a9d1837b903a69deaf09879278156d03852b35a57613b248b84ff9700c9b53f49af091942a
SSDEEP

6144:bHEeraRbpt5e3JVAfqX+2Rr+nxQDBO03yDLC:rEk6z5mvAfLf0

Score

10^/10

qakbot star01 1634935795 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

star01

Campaign

1634935795

C2

45.9.20.200:443

96.246.158.154:995

67.165.206.193:993

207.246.112.221:443

37.208.181.198:61202

77.255.12.88:443

79.160.207.214:443

216.201.162.158:443

185.53.147.51:443

187.250.109.250:443

173.21.10.71:2222

108.4.67.252:443

93.175.84.127:443

84.117.135.69:443

87.64.241.207:995

207.246.112.221:995

188.50.34.167:995

73.25.109.183:2222

213.177.130.71:443

176.63.117.1:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421.exe
- Size
  
  512KB
- MD5
  
  ac2cec3f240393f9015b7c6754bdef59
- SHA1
  
  36c5790aae838a0fc04f81da8c364bdb04208707
- SHA256
  
  76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421
- SHA512
  
  3447a336e0b2e8206e77d874abc9b0c2d01c5ea87172b25b707d90a9d1837b903a69deaf09879278156d03852b35a57613b248b84ff9700c9b53f49af091942a
- SSDEEP
  
  6144:bHEeraRbpt5e3JVAfqX+2Rr+nxQDBO03yDLC:rEk6z5mvAfLf0
Score

10^/10

qakbot star01 1634935795 banker discovery evasion stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotstar011634935795bankerdiscoveryevasionstealertrojan

behavioral2

qakbotstar011634935795bankerdiscoveryevasionstealertrojan