qakbot | a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a

Sharing

Copy URL Twitter E-mail

General

Target
besta.ocx
Size 809KB
Sample211201-mkfahaeeb4
SHA256 a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a
MD5 ff7813f09571dfdafaf75abffdc7aab1
SHA1 200f8b4ce6d49a3a13b42c590ff176bc9811dd5c
SHA512 b70bee594554bb64f376f73f3fb88d4d086539c86b6f37897c5e6328a9c7d6d8d1778b871ff28ddaa97a6b9dc37ea30a0446cc3e58b299e9b0ee6aca92c52a30
MD5 SHA1 SHA512

Score

10^/10

qakbot tr 1638169179 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

Campaign

1638169179

136.232.34.70:443
117.248.109.38:21
218.101.110.3:995
140.82.49.12:443
102.65.38.57:443
136.143.11.232:443
39.33.188.131:995
76.25.142.196:443
120.150.218.241:995
189.252.156.7:32101
185.53.147.51:443
103.142.10.177:443
117.198.159.148:443
217.165.237.42:443
216.238.71.31:443
207.246.112.221:995
207.246.112.221:443
45.46.53.140:2222
173.21.10.71:2222
67.165.206.193:993
189.135.21.162:443
71.74.12.34:443
86.8.177.143:443
174.20.72.123:443
73.151.236.31:443
94.60.254.81:443
89.137.52.44:443
89.101.97.139:443
109.12.111.14:443
68.204.7.158:443
27.5.4.111:2222
129.208.177.244:995
105.198.236.99:995
65.100.174.110:8443
94.200.181.154:443
65.100.174.110:995
63.143.92.99:995
201.172.31.95:80
75.188.35.168:995
186.64.67.16:443
39.49.33.135:995
182.176.180.73:443
194.36.28.26:443
103.116.178.85:993
75.66.88.33:443
187.156.138.52:443
200.114.247.160:465
189.147.174.121:443
24.139.72.117:443
75.169.58.229:32100
5.31.189.54:995
86.120.85.147:443
93.48.80.198:995
2.222.167.138:443
197.89.6.112:443
27.57.252.156:443
103.150.40.76:995
41.228.22.180:443
81.250.153.227:2222
88.244.161.183:995
111.250.48.162:443
50.194.160.233:32100
50.194.160.233:443
24.55.112.61:443
73.140.38.124:443
108.4.67.252:443
176.63.117.1:22
100.1.119.41:443
24.229.150.54:995
111.91.87.187:443
86.97.10.14:443
220.255.25.187:2222
92.59.35.196:2222
72.252.201.34:465
209.210.95.228:443
68.186.192.69:443
187.121.105.111:995
103.168.241.157:995
103.168.241.157:465
86.190.203.103:443
93.147.212.206:443
5.238.149.217:61202
72.252.201.34:995
24.152.219.253:995
96.37.113.36:993
45.9.20.200:2211
190.73.3.148:2222
80.6.192.58:443
103.116.178.85:61200
93.48.58.123:2222
27.223.92.142:995
91.178.126.51:995
41.235.5.174:443
96.246.158.154:995
50.194.160.233:465
96.21.251.127:2222
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  besta.ocx
- Size 809KB
- SHA256 a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a
- MD5 ff7813f09571dfdafaf75abffdc7aab1
- SHA1 200f8b4ce6d49a3a13b42c590ff176bc9811dd5c
- SHA512 b70bee594554bb64f376f73f3fb88d4d086539c86b6f37897c5e6328a9c7d6d8d1778b871ff28ddaa97a6b9dc37ea30a0446cc3e58b299e9b0ee6aca92c52a30
- MD5 SHA1 SHA512
Score

10^/10

qakbot tr 1638169179 banker evasion stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Windows security bypass

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2