qakbot | d20b23f825b578b8eb266dce9bc9d89c1aaa38ea972924e59b599fe4fac4d3b9

General

Target

payload.exe
Size

203KB
Sample

240626-vefyvawekn
MD5

58c8c22e91018f44225a304155ca4e6d
SHA1

3cd30cbb04dbf56ae648b2e1372fd28e5999a01b
SHA256

d20b23f825b578b8eb266dce9bc9d89c1aaa38ea972924e59b599fe4fac4d3b9
SHA512

6d27198431e1481dbb42602bb7869d15e2a8d06d4274bfe4c8a4b5ea125afe03cb2bf7c1ad0254a77e5b0e201c1aad3755dbd956484c355542a43fb9843bcd91
SSDEEP

6144:XwthojqrStgEcMMtoJxtwyDuVWajrZX7lMFKUq:XwEIicpSJopw8

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

spx156

Campaign

1597661994

C2

98.26.50.62:995

46.53.40.244:443

86.98.89.40:2222

108.30.125.94:443

189.130.26.216:443

96.37.113.36:993

216.201.162.158:443

24.37.178.158:443

73.228.1.246:443

175.111.128.234:443

95.77.144.238:443

41.36.58.89:995

84.247.55.190:443

66.215.32.224:443

67.6.3.51:443

197.37.219.90:993

144.202.48.107:443

49.191.130.48:443

73.214.248.17:995

24.44.142.213:2222

Targets

- Target
  
  payload.exe
- Size
  
  203KB
- MD5
  
  58c8c22e91018f44225a304155ca4e6d
- SHA1
  
  3cd30cbb04dbf56ae648b2e1372fd28e5999a01b
- SHA256
  
  d20b23f825b578b8eb266dce9bc9d89c1aaa38ea972924e59b599fe4fac4d3b9
- SHA512
  
  6d27198431e1481dbb42602bb7869d15e2a8d06d4274bfe4c8a4b5ea125afe03cb2bf7c1ad0254a77e5b0e201c1aad3755dbd956484c355542a43fb9843bcd91
- SSDEEP
  
  6144:XwthojqrStgEcMMtoJxtwyDuVWajrZX7lMFKUq:XwEIicpSJopw8
Score

10^/10

qakbot spx156 1597661994 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2