qakbot | 66d36ffbcdd8919b6527110a03fe917c1e47dac123778945305b3baa395631f0

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
Size 5.9MB
Sample260903-bb4e7a1xhs
SHA256 66d36ffbcdd8919b6527110a03fe917c1e47dac123778945305b3baa395631f0
MD5 0fb531c7f6e841e36cefbaff58c70949
SHA1 3d50ffcef573588c637020ce3f41dd13b14b35f4
SHA512 9c29540a4bd9a22f8f68e41a02c0935602afbd7c4db6171ae8fd45b2b3894d43a78d7c40d2908cf347923d34a7bb2b9b90d9c003996117c9f12ab7d648162eab
SSDEEP 6144:1PIpEvUeazs9JSMeyUPFlsy4SEUY3V2kz5t8FF9SSl9sciUNhK0:BIpqdaNMeyUPFlR4SEU+VpdITiU3b
TLSH
T16C56549215C37F8ED31A3AF1257A12E23F518B4850EE446DC878FE54EE0B9BD908A747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker tr01 1596554163 discovery execution qakbot stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.14

Botnet

tr01

Campaign

1596554163

94.59.241.189:2222
86.98.66.175:2222
94.96.84.73:993
71.83.16.211:443
24.110.96.149:443
78.96.199.79:443
216.201.162.158:443
68.60.221.169:465
95.76.109.181:443
189.231.175.46:443
70.164.37.205:995
108.27.217.44:443
71.220.191.200:443
92.59.35.196:2222
71.192.44.92:443
108.30.125.94:443
93.151.180.170:61202
189.130.26.216:443
47.146.32.175:443
24.71.28.247:443
12.5.37.3:995
79.113.219.10:443
70.126.76.75:443
78.100.192.173:443
199.247.22.145:443
5.193.178.241:2078
144.202.48.107:443
90.175.88.99:2222
81.133.234.36:2222
151.73.120.201:443
166.62.180.194:2078
201.216.216.245:443
103.238.231.40:443
187.205.235.21:443
189.210.114.157:443
68.116.193.239:443
84.117.176.32:443
151.52.157.19:443
188.26.243.186:443
108.45.89.47:443
179.14.167.91:443
189.223.67.126:443
94.96.84.73:21
75.170.94.218:443
174.80.7.235:443
68.134.181.98:443
86.120.237.47:2222
51.9.198.243:2222
94.96.84.73:20
172.87.134.226:443
189.150.106.26:995
188.15.173.34:995
24.204.155.208:443
63.155.9.141:995
96.20.108.17:2222
187.192.233.135:995
115.21.224.117:443
98.4.227.199:443
5.15.54.233:443
217.165.112.13:995
207.255.161.8:993
86.126.206.141:443
188.25.192.41:443
78.97.207.104:443
189.140.64.53:443
209.182.122.217:443
173.173.72.199:443
35.134.202.234:443
134.0.196.46:995
75.136.40.155:443
70.95.118.217:443
67.6.62.74:443
186.28.178.94:443
98.173.34.212:995
173.22.120.11:2222
108.46.145.30:443
108.35.135.148:443
94.96.84.73:443
86.97.9.224:443
67.11.43.93:443
154.56.71.174:443
24.99.180.247:443
65.48.219.163:443
69.47.26.41:443
188.27.27.107:443
67.247.254.82:443
172.78.82.95:443
72.204.242.138:6881
199.247.16.80:443
80.240.26.178:443
76.187.12.181:443
5.13.102.138:995
86.153.98.2:2222
208.93.202.49:443
96.35.170.82:2078
2.51.240.61:995
67.165.206.193:993
5.15.84.129:443
67.8.103.21:443
151.205.102.42:443
96.232.203.15:443
72.240.200.181:2222
70.123.92.175:2222
73.228.1.246:443
75.111.145.5:995
24.231.54.185:2222
98.115.243.237:443
96.234.20.230:443
96.255.188.58:443
174.82.131.155:995
90.68.84.121:2222
73.227.232.166:443
71.182.142.63:443
109.92.251.113:995
24.139.132.70:443
130.25.130.19:2222
35.143.248.234:443
190.204.24.148:2078
45.32.155.12:443
173.163.115.89:2078
207.246.75.201:443
35.209.218.146:443
45.32.154.10:443
217.162.149.212:443
72.142.106.198:995
75.137.47.174:443
83.110.92.29:443
36.226.77.179:443
5.107.157.123:2222
176.205.255.97:443
213.120.109.73:2222
41.97.200.95:443
2.88.50.153:995
173.44.112.112:443
200.38.254.177:443
24.229.150.54:995
71.10.43.79:443
72.82.15.220:443
99.231.221.117:443
47.44.217.98:443
186.6.197.11:443
217.165.164.57:2222
71.88.104.107:443
68.204.164.222:443
73.104.218.229:0
173.245.152.231:443
24.203.36.180:2222
86.98.89.132:2222
24.28.183.107:995

Signatures

Family: Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3528	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3528	cmd.exe
1416	PING.EXE

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1416	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5424	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
5424	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
1992	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
1992	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
1992	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
1992	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5424 wrote to memory of 1992	5424	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe	89
PID 5424 wrote to memory of 3528	5424	0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe	91
PID 3528 wrote to memory of 1416	3528	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Users\Admin\AppData\Local\Temp\0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe /C
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1416