qakbot | b0d1c023b6d76e39737cdff7058dd41f807c0b323e7700483be7e36229761e58 | Triage

Sharing

General

Target

JaffaCakes118_2cc04bf4aecfce33b2ebd9c71aedcbdc
Size

1.2MB
Sample

250106-td1q7asqbr
MD5

2cc04bf4aecfce33b2ebd9c71aedcbdc
SHA1

902bfd3643ae1aacd0f73a7bf30b8915347733bd
SHA256

b0d1c023b6d76e39737cdff7058dd41f807c0b323e7700483be7e36229761e58
SHA512

7dd55427928024e5fed14b28da8065f04fe407b817b6e2d4bd024e106a509eb40f4add28ac5d876c8694c092e32015443db995b19ee087440e463391a2bcd016
SSDEEP

24576:ww7BZFodRlyc501VWUMkTjACzDSMPhy5DipHl950JkSr+qk5acKVv8dzF+7:HLt18UMeTzD3pbpr50mSrtkIcKVvuh+7

Score

10^/10

qakbot tr 1633943125 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633943125

C2

140.82.49.12:443

89.137.52.44:443

24.107.165.50:443

66.216.193.114:443

75.131.217.182:443

41.86.42.158:995

24.119.214.7:443

67.166.233.75:443

105.198.236.99:443

120.151.47.189:443

2.222.167.138:443

41.228.22.180:443

78.105.213.151:995

5.193.125.67:995

41.86.42.158:443

96.57.188.174:2078

120.150.218.241:995

66.177.215.152:0

122.11.220.212:2222

73.52.50.32:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  JaffaCakes118_2cc04bf4aecfce33b2ebd9c71aedcbdc
- Size
  
  1.2MB
- MD5
  
  2cc04bf4aecfce33b2ebd9c71aedcbdc
- SHA1
  
  902bfd3643ae1aacd0f73a7bf30b8915347733bd
- SHA256
  
  b0d1c023b6d76e39737cdff7058dd41f807c0b323e7700483be7e36229761e58
- SHA512
  
  7dd55427928024e5fed14b28da8065f04fe407b817b6e2d4bd024e106a509eb40f4add28ac5d876c8694c092e32015443db995b19ee087440e463391a2bcd016
- SSDEEP
  
  24576:ww7BZFodRlyc501VWUMkTjACzDSMPhy5DipHl950JkSr+qk5acKVv8dzF+7:HLt18UMeTzD3pbpr50mSrtkIcKVvuh+7
Score

10^/10

qakbot tr 1633943125 banker discovery evasion stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbottr1633943125bankerdiscoveryevasionstealertrojan

behavioral2

qakbottr1633943125bankerdiscoveryevasionstealertrojan