qakbot | a0b011497c8ab2d17605701a9bbb6f900d9b2b513c55070e6cbbc401388c10a6 | Triage

Sharing

General

Target

a0b011497c8ab2d17605701a9bbb6f900d9b2b513c55070e6cbbc401388c10a6N.exe
Size

574KB
Sample

250225-ev1eestnv4
MD5

5ec3439b0a4ea164eac084facb91c1e0
SHA1

cd44104d773da4b6a308a65612c0b60f34fbb7c5
SHA256

a0b011497c8ab2d17605701a9bbb6f900d9b2b513c55070e6cbbc401388c10a6
SHA512

d127951cbdf8bce17c40d9579eef16e7e9f6e7a79a7a46987d19471ba5d690b423759e91a11f180b4f791f561b7d4e6ccc6f5efe86d2aec4a40f8153bf3f962d
SSDEEP

6144:4G5acc4UubGLev55w9A/tN52IMI2CrC+Ey+23Pq/OaIU+BHoa8mSpPah8iTKp3hP:42lXJvzUAnUIMIvmM/6OID9SM6FDacBA

Score

10^/10

qakbot notset 1590741916 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

notset

Campaign

1590741916

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

C2

108.227.161.27:995

173.187.103.35:443

117.216.185.86:443

24.43.22.220:443

72.190.101.70:443

207.255.161.8:2087

189.160.217.221:443

207.255.161.8:32102

24.226.137.154:443

66.222.88.126:995

108.58.9.238:995

1.40.42.4:443

47.152.210.233:443

72.45.14.185:443

82.127.193.151:2222

101.108.113.6:443

175.111.128.234:995

175.111.128.234:443

47.39.76.74:443

5.12.214.109:2222

Targets

- Target
  
  a0b011497c8ab2d17605701a9bbb6f900d9b2b513c55070e6cbbc401388c10a6N.exe
- Size
  
  574KB
- MD5
  
  5ec3439b0a4ea164eac084facb91c1e0
- SHA1
  
  cd44104d773da4b6a308a65612c0b60f34fbb7c5
- SHA256
  
  a0b011497c8ab2d17605701a9bbb6f900d9b2b513c55070e6cbbc401388c10a6
- SHA512
  
  d127951cbdf8bce17c40d9579eef16e7e9f6e7a79a7a46987d19471ba5d690b423759e91a11f180b4f791f561b7d4e6ccc6f5efe86d2aec4a40f8153bf3f962d
- SSDEEP
  
  6144:4G5acc4UubGLev55w9A/tN52IMI2CrC+Ey+23Pq/OaIU+BHoa8mSpPah8iTKp3hP:42lXJvzUAnUIMIvmM/6OID9SM6FDacBA
Score

10^/10

qakbot notset 1590741916 banker discovery stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotnotset1590741916bankerdiscoverystealertrojan

behavioral2

qakbotnotset1590741916bankerdiscoverystealertrojan