qakbot | 6ad1fa659db01a4985dae4be70262cf9c458f0c3e4a3437333d71112eba81e80 | Triage

Sharing

General

Target

6ad1fa659db01a4985dae4be70262cf9c458f0c3e4a3437333d71112eba81e80.exe
Size

572KB
Sample

241123-v6awxaynet
MD5

4731ca22c3107b5ec08fb49ee58e39f7
SHA1

cdfe60c5a09834f98dca5ba1fba3d6e23ca21552
SHA256

6ad1fa659db01a4985dae4be70262cf9c458f0c3e4a3437333d71112eba81e80
SHA512

e7831827e1c92d8f0ec207adbf4bdbb93b76bc631642063b4f7ee32a1cc3e0ea4e97c5e53e0cbb401fd970330db741df356cfbce7e1fa6c95d9a4823c43ed39b
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eH50:VvAfLfaEkAz5e0

Score

10^/10

qakbot obama114 1634112211 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  6ad1fa659db01a4985dae4be70262cf9c458f0c3e4a3437333d71112eba81e80.exe
- Size
  
  572KB
- MD5
  
  4731ca22c3107b5ec08fb49ee58e39f7
- SHA1
  
  cdfe60c5a09834f98dca5ba1fba3d6e23ca21552
- SHA256
  
  6ad1fa659db01a4985dae4be70262cf9c458f0c3e4a3437333d71112eba81e80
- SHA512
  
  e7831827e1c92d8f0ec207adbf4bdbb93b76bc631642063b4f7ee32a1cc3e0ea4e97c5e53e0cbb401fd970330db741df356cfbce7e1fa6c95d9a4823c43ed39b
- SSDEEP
  
  6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eH50:VvAfLfaEkAz5e0
Score

10^/10

qakbot obama114 1634112211 banker discovery evasion stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotobama1141634112211bankerdiscoveryevasionstealertrojan

behavioral2

qakbotobama1141634112211bankerdiscoveryevasionstealertrojan