Technical analysis of the QakBot banking Trojan
Tags
cmtmf-attack-pattern: Process Injection
maec-delivery-vectors: Watering Hole
attack-pattern: Data Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 External Proxy - T1090.002 Hooking - T1617 Ip Addresses - T1590.005 Javascript - T1059.007 Malware - T1587.001 Malware - T1588.001 Phishing - T1660 Phishing - T1566 Process Injection - T1631 Server - T1583.004 Server - T1584.004 Software - T1592.002 Vnc - T1021.005 Connection Proxy - T1090 Hooking - T1179 Process Injection - T1055 Hooking
Show in Graph
Common Information
Type Value
UUID 6937d674-ef17-4d41-9c1e-caebdf072266
Fingerprint fa371dd10ca1b5d4
Analysis status DONE
Considered CTI value 0
Text language
Published Sept. 2, 2021, 10 a.m.
Added to db Sept. 11, 2022, 12:47 p.m.
Last updated Oct. 16, 2024, 2:27 a.m.
Headline QakBot technical analysis
Title Technical analysis of the QakBot banking Trojan
Detected Hints/Tags/Attributes 84/3/3
Source URLs
Redirection Url
Details Source https://securelist.com/qakbot-technical-analysis/103931/
URL Provider
Details Provider Source level domain
Details securelist.com securelist.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
signed.in
Details File 52 
trojan.js
Details File 22 
trojan-downloader.js