qakbot | 3fd5271930f8a204243a54f26bd0fe78840614b400e4accbba09d36c6d012fc4

Sharing

Copy URL Twitter E-mail

General

Target
3fd5271930f8a204243a54f26bd0fe78840614b400e4accbba09d36c6d012fc4
Size 189KB
Sample260901-mfvvdsbr8v
SHA256 3fd5271930f8a204243a54f26bd0fe78840614b400e4accbba09d36c6d012fc4
MD5 2a6f0fcc9e43637b25b25332b17cf2fd
SHA1 240fc7fc19621f73aa15d1d8e9909f99fdff2ff2
SHA512 50181e1fd693b9e61e1d2206a3b7fb6f67a569b79e64e6d202faca582561cfc57c17068ead499134253a57a997b5eebd8a5b3b61dbf533834e13912fe612ac31
SSDEEP 3072:eOOoSXj7yLB4aGww4uddjFTlzVpL2p/zxWhhNlPNrXB4OgW+Ag1tsdLcN:eOOoamB4d34ubJsAH3NV4O7+A9
TLSH
T139149C02EA91D036E0A300B412651BB66EFDFE312365D5EBC7D86BC24A789D2D635337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan banker stealer qakbot

Malware Config

Signatures

Family: Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fd5271930f8a204243a54f26bd0fe78840614b400e4accbba09d36c6d012fc4

File Explorer

3fd5271930f8a204243a54f26bd0fe78840614b400e4accbba09d36c6d012fc4

.dll 189KB

3fd5271930f8a204243a54f26bd0fe78840614b400e4accbba09d36c6d012fc4

IMPHASH aaedbf9de25cef91a699f7cdd88d0819
SHA256 3fd5271930f8a204243a54f26bd0fe78840614b400e4accbba09d36c6d012fc4
MD5 2a6f0fcc9e43637b25b25332b17cf2fd
SHA1 240fc7fc19621f73aa15d1d8e9909f99fdff2ff2
SHA512 50181e1fd693b9e61e1d2206a3b7fb6f67a569b79e64e6d202faca582561cfc57c17068ead499134253a57a997b5eebd8a5b3b61dbf533834e13912fe612ac31
SSDEEP 3072:eOOoSXj7yLB4aGww4uddjFTlzVpL2p/zxWhhNlPNrXB4OgW+Ag1tsdLcN:eOOoamB4d34ubJsAH3NV4O7+A9
TLSH
T139149C02EA91D036E0A300B412651BB66EFDFE312365D5EBC7D86BC24A789D2D635337
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

iphlpapi

GetBestRoute GetIpAddrTable

dnsapi

DnsQuery_A DnsRecordListFree

ws2_32

gethostbyaddr ioctlsocket listen WSAGetLastError connect getnameinfo htons setsockopt bind getaddrinfo sendto freeaddrinfo socket WSAIoctl accept htonl inet_addr WSAStartup WSACleanup inet_ntoa gethostbyname ntohs getsockname select __WSAFDIsSet closesocket send recv

shell32

SHGetFolderPathA

shlwapi

StrCmpNA PathCombineA PathMatchSpecA wvnsprintfW wvnsprintfA

ole32

CoTaskMemFree CoCreateInstance CoInitialize CoInitializeSecurity CoInitializeEx CoUninitialize

kernel32

SetLastError OpenEventA GetThreadContext VirtualProtectEx WriteProcessMemory ExpandEnvironmentStringsA CreateProcessA GetTickCount GetWindowsDirectoryA SetEnvironmentVariableA GetModuleFileNameA GetSystemInfo VirtualAlloc WriteFile FlushFileBuffers LocalAlloc lstrcmpW lstrcpyA lstrlenA SetEvent CreateEventA lstrcmpA ResetEvent CreateMutexA SleepEx DuplicateHandle GetCurrentThread GetCurrentProcess Sleep TerminateThread lstrcatA MoveFileA MoveFileExA GetLastError SetThreadPriority GetEnvironmentVariableA lstrcpynW lstrlenW lstrcatW lstrcmpiW DisconnectNamedPipe ReadFile ConnectNamedPipe CreateNamedPipeA ExitProcess CloseHandle WaitForSingleObject GetProcessId TerminateProcess GetCurrentProcessId CreateThread CreateFileA GetLocalTime LoadLibraryA GetComputerNameA DeleteFileA CreateDirectoryA DeleteFileW LeaveCriticalSection EnterCriticalSection WaitForMultipleObjects InitializeCriticalSection GetComputerNameW DeleteCriticalSection GetVersionExA lstrcmpiA HeapAlloc GetProcessHeap HeapReAlloc HeapFree QueryPerformanceCounter QueryPerformanceFrequency GetFileSize GetFileAttributesA HeapCreate GetProcAddress SystemTimeToFileTime GetSystemTime FreeLibrary WideCharToMultiByte MultiByteToWideChar GetModuleHandleA ReleaseMutex LoadResource SizeofResource FindResourceA SetFilePointer lstrcpyW GetExitCodeProcess ResumeThread CopyFileA SetFileAttributesA LocalFree GetFileAttributesW

user32

MessageBoxW IsCharAlphaNumericA MessageBoxA DialogBoxParamA DialogBoxParamW GetWindowTextA PostMessageA FindWindowA GetWindowLongA GetWindowTextW

advapi32

GetSidSubAuthorityCount RegCloseKey RegQueryInfoKeyA RegOpenKeyExA GetUserNameW CryptAcquireContextA LookupAccountSidA AllocateAndInitializeSid SetEntriesInAclA InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityInfo RegEnumKeyExA GetSidSubAuthority GetTokenInformation OpenThreadToken OpenProcessToken SetFileSecurityA EqualSid

oleaut32

SysFreeString VariantClear VariantInit