Overview

overview

10

Static

static

Fikol.exe

windows7_x64

10

Fikol.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Fikol.exe
  • Size 993KB
  • Sample201005-xcgcytx2ba
  • SHA256 da9694c6c6f520b9068714b76a3cfce6f4609072f8777be7efb4e1878a6c4feb
  • MD5 SHA1 SHA512
Score
10/10
qakbotabc0131601889478bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Botnet

  • abc013

Campaign

  • 1601889478

C2

  • 199.116.241.147:443

  • 71.187.170.235:443

  • 71.126.139.251:443

  • 2.50.159.48:2222

  • 31.5.168.31:443

  • 190.85.91.154:443

  • 173.245.152.231:443

  • 39.36.218.78:995

  • 78.96.199.79:443

  • 172.78.30.215:443

  • 61.230.5.67:443

  • 197.133.117.15:443

  • 24.213.191.38:0

  • 184.97.132.62:443

  • 96.227.127.13:443

  • 24.218.181.15:443

  • 96.30.198.161:443

  • 77.27.174.49:995

  • 45.77.193.83:443

  • 207.246.75.201:443

Targets

    • Target
      Fikol.exe
    • Size 993KB
    • SHA256 da9694c6c6f520b9068714b76a3cfce6f4609072f8777be7efb4e1878a6c4feb
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbankerstealerqakbot

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks