qakbot | f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb

Sharing

Copy URL Twitter E-mail

General

Target
44468.7122434028.dat
Size 708KB
Sample210929-vcs6dsfch4
SHA256 f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb
MD5 5d525597ac63c8b29d42c879b8d34279
SHA1 9422595b557dcff273aa393752a48393d80c8bf7
SHA512 b7b269a08b5fcb6e595e5c82c7c63323dce03f06d364b42aef33f8e9f8ad38622af49e0181ecfbd2713d4d177cc7898352c596bad80d4a7c8c773d3dd8db9ea6
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama106

Campaign

1632905607

37.210.152.224:995
120.151.47.189:443
105.198.236.99:443
122.11.220.212:2222
199.27.127.129:443
41.251.41.14:995
216.201.162.158:443
124.123.42.115:2078
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
217.17.56.163:443
182.181.78.18:995
140.82.49.12:443
105.159.144.186:995
89.101.97.139:443
217.17.56.163:0
27.223.92.142:995
95.77.223.148:443
109.190.253.11:2222
81.250.153.227:2222
190.198.206.189:2222
81.241.252.59:2078
136.232.34.70:443
47.22.148.6:443
93.8.66.216:443
124.123.42.115:2222
217.17.56.163:2222
217.17.56.163:2078
217.17.56.163:465
41.228.22.180:443
76.25.142.196:443
71.74.12.34:443
71.80.168.245:443
75.188.35.168:443
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
67.165.206.193:993
38.10.201.211:443
72.252.201.69:443
71.60.246.5:443
92.148.59.207:2222
92.157.171.41:2222
24.139.72.117:443
186.18.205.199:995
24.229.150.54:995
47.40.196.233:2222
24.55.112.61:443
177.130.82.197:2222
109.12.111.14:443
68.204.7.158:443
186.87.135.68:995
80.6.192.58:443
103.148.120.144:443
75.66.88.33:443
173.25.166.81:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.108.147:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443

Targets

- Target
  44468.7122434028.dat
- Size 708KB
- SHA256 f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb
- MD5 5d525597ac63c8b29d42c879b8d34279
- SHA1 9422595b557dcff273aa393752a48393d80c8bf7
- SHA512 b7b269a08b5fcb6e595e5c82c7c63323dce03f06d364b42aef33f8e9f8ad38622af49e0181ecfbd2713d4d177cc7898352c596bad80d4a7c8c773d3dd8db9ea6
- MD5 SHA1 SHA512
Score

10^/10

qakbot obama106 1632905607 banker evasion stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Windows security bypass

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2