qakbot | 0023fccc4b4a3d75236ebd303555857ae88691f9aafe2ed5d1ea3d66d6382a31 | Triage

Sharing

General

Target

JaffaCakes118_89b2a3f96b90720cb1df7a430845a3c4
Size

534KB
Sample

250108-ee8qvssqgy
MD5

89b2a3f96b90720cb1df7a430845a3c4
SHA1

c6a44201dfd1d954f2a3ec95061d2a38b3efeee6
SHA256

0023fccc4b4a3d75236ebd303555857ae88691f9aafe2ed5d1ea3d66d6382a31
SHA512

9d9a633ff4e5c0e553af7d708a4bbacd4b3d19c40515d6426d2fac997c7e3342909a7a979013957d988e249c044b825344234d910becea9d47563685332a4791
SSDEEP

3072:vxAqb35qSyYNYuFwXBBWYn0WWeP24iABEabz1fz+Bnp1WC3polyaSXO3etYkpHsk:yqb35qjY7wXrNJicLfz+hqv4BtYyxD

Score

10^/10

qakbot biden54 1634802135 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634802135

C2

81.250.153.227:2222

120.150.218.241:995

76.25.142.196:443

63.143.92.99:995

89.101.97.139:443

136.143.11.232:443

81.213.59.22:443

136.232.34.70:443

140.82.49.12:443

37.208.181.198:61200

78.191.24.189:995

216.201.162.158:443

197.89.144.102:443

89.137.52.44:443

182.176.180.73:443

173.21.10.71:2222

117.198.156.56:443

196.207.140.40:995

103.142.10.177:443

24.231.209.2:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  JaffaCakes118_89b2a3f96b90720cb1df7a430845a3c4
- Size
  
  534KB
- MD5
  
  89b2a3f96b90720cb1df7a430845a3c4
- SHA1
  
  c6a44201dfd1d954f2a3ec95061d2a38b3efeee6
- SHA256
  
  0023fccc4b4a3d75236ebd303555857ae88691f9aafe2ed5d1ea3d66d6382a31
- SHA512
  
  9d9a633ff4e5c0e553af7d708a4bbacd4b3d19c40515d6426d2fac997c7e3342909a7a979013957d988e249c044b825344234d910becea9d47563685332a4791
- SSDEEP
  
  3072:vxAqb35qSyYNYuFwXBBWYn0WWeP24iABEabz1fz+Bnp1WC3polyaSXO3etYkpHsk:yqb35qjY7wXrNJicLfz+hqv4BtYyxD
Score

10^/10

qakbot biden54 1634802135 banker discovery evasion stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotbiden541634802135bankerdiscoveryevasionstealertrojan

behavioral2

qakbotbiden541634802135bankerdiscoveryevasionstealertrojan