qakbot | e055a9749b019a264531d5cb9eec06980f93a74e9e886bf0eba57e9c56f706dd | Triage

Sharing

General

Target

JaffaCakes118_05f82bbe64559994c8bc1d6a6a9055f3
Size

890KB
Sample

250106-bmyzvatmdj
MD5

05f82bbe64559994c8bc1d6a6a9055f3
SHA1

8d1d5870ffc385c7e1937059795cb7ace08fd551
SHA256

e055a9749b019a264531d5cb9eec06980f93a74e9e886bf0eba57e9c56f706dd
SHA512

0fde6b00425fbac8bf35823dce38b2c5a3e101c77f981f96040dabe8f10911ff5bbac8a22828da3cdaaca827605be68d17c17cb3a755ca3aaf146e72b4f3af42
SSDEEP

24576:svmCko3miQH9ZfSCFEz8uViMKvb/o2ggJcWieQRqg:svme3m1jSCFMKvjjXJcL9qg

Score

10^/10

qakbot biden54 1634810637 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634810637

C2

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  JaffaCakes118_05f82bbe64559994c8bc1d6a6a9055f3
- Size
  
  890KB
- MD5
  
  05f82bbe64559994c8bc1d6a6a9055f3
- SHA1
  
  8d1d5870ffc385c7e1937059795cb7ace08fd551
- SHA256
  
  e055a9749b019a264531d5cb9eec06980f93a74e9e886bf0eba57e9c56f706dd
- SHA512
  
  0fde6b00425fbac8bf35823dce38b2c5a3e101c77f981f96040dabe8f10911ff5bbac8a22828da3cdaaca827605be68d17c17cb3a755ca3aaf146e72b4f3af42
- SSDEEP
  
  24576:svmCko3miQH9ZfSCFEz8uViMKvb/o2ggJcWieQRqg:svme3m1jSCFMKvjjXJcL9qg
Score

10^/10

qakbot biden54 1634810637 banker discovery evasion stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotbiden541634810637bankerdiscoveryevasionstealertrojan

behavioral2

qakbotbiden541634810637bankerdiscoveryevasionstealertrojan