qakbot | c0cd11b1a1f30dcbb31694e887195aa4e39aae9f108aa55f193f0edfc4b83149 | Triage

Sharing

General

Target

c0cd11b1a1f30dcbb31694e887195aa4e39aae9f108aa55f193f0edfc4b83149.exe
Size

574KB
Sample

250224-p6157stlt2
MD5

dd51ceba2a3c0ff30fa6fac4f727c50c
SHA1

453765e0daf994286bd73219edcd6f1ea90e1fbb
SHA256

c0cd11b1a1f30dcbb31694e887195aa4e39aae9f108aa55f193f0edfc4b83149
SHA512

bb76497f8d6b9a6e519512b36bc02ac55c4414d6047d81b49622e585ae617d93ffba9ba393013f712a134819b98241969e806eb94d3a89cc811c1e01d92b1bae
SSDEEP

6144:4G5acc4UubGLev55w9A/tN52IMI2CrC+Ey+23Pq/OaIU+BHoa8mSpPah8iTKp3hf:42lXJvzUAnUIMIvmM/6OID9SM6FDacBA

Score

10^/10

qakbot notset 1590741916 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

notset

Campaign

1590741916

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

C2

108.227.161.27:995

173.187.103.35:443

117.216.185.86:443

24.43.22.220:443

72.190.101.70:443

207.255.161.8:2087

189.160.217.221:443

207.255.161.8:32102

24.226.137.154:443

66.222.88.126:995

108.58.9.238:995

1.40.42.4:443

47.152.210.233:443

72.45.14.185:443

82.127.193.151:2222

101.108.113.6:443

175.111.128.234:995

175.111.128.234:443

47.39.76.74:443

5.12.214.109:2222

Targets

- Target
  
  c0cd11b1a1f30dcbb31694e887195aa4e39aae9f108aa55f193f0edfc4b83149.exe
- Size
  
  574KB
- MD5
  
  dd51ceba2a3c0ff30fa6fac4f727c50c
- SHA1
  
  453765e0daf994286bd73219edcd6f1ea90e1fbb
- SHA256
  
  c0cd11b1a1f30dcbb31694e887195aa4e39aae9f108aa55f193f0edfc4b83149
- SHA512
  
  bb76497f8d6b9a6e519512b36bc02ac55c4414d6047d81b49622e585ae617d93ffba9ba393013f712a134819b98241969e806eb94d3a89cc811c1e01d92b1bae
- SSDEEP
  
  6144:4G5acc4UubGLev55w9A/tN52IMI2CrC+Ey+23Pq/OaIU+BHoa8mSpPah8iTKp3hf:42lXJvzUAnUIMIvmM/6OID9SM6FDacBA
Score

10^/10

qakbot notset 1590741916 banker discovery stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotnotset1590741916bankerdiscoverystealertrojan

behavioral2

qakbotnotset1590741916bankerdiscoverystealertrojan