QakBotMalware
- oakboat
- pinkslipbot
- quackbot
- quakbot
QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.From MISP Galaxy
Last reported 8 months ago, by Huntress3 reports
ATT&CK techniques
6 of 36 · each with the sentence it comes from- T1053.005Scheduled Task
“In some cases, a scheduled task is used to run PowerShell:”
- T1055Process Injection
“…e/Decode Files or Information (T1140), Disabling Security Tools (T1089), File Deletion (T1107), Masquerading (T1036), Process Injection (T1055)”
- T1110Brute Force
“Credential Dumping (T1003), Brute Force (T1110), Input Capture (T1056)”
- T1003OS Credential Dumping
“Credential Dumping (T1003), Brute Force (T1110), Input Capture (T1056)”
- T1005Data from Local System
“Data from Local System (T1005), Data from Network Shared Drive (T1039), Data Staged (T1074)”
- T1018Remote System Discovery
“…1482), File and Directory Discovery (T1083), Network Service Scanning (T1046), Network Share Discovery (T1135), Remote System Discovery (T1018)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
A New RAT and a Hands-on-Keyboard Intrusion“Over the years, Matanbuchus has been used to deliver a range of follow-on payloads, including Cobalt Strike, QakBot, DanaBot, Rhadamanthys stealer, and NetSupport RAT.”
-
Threat Advisory: Qakbot Activity Is Rising“QakBot is continuously maintained and developed and has evolved from a banking trojan information stealer, to form botnets, and into a delivery agent for ransomware.”
-
ATT&CKing ProLock Ransomware“ProLock operators used two main vectors of initial access: QakBot (Qbot) and unprotected Remote Desktop Protocol (RDP)-servers with weak credentials.”
Indicators in its reports
named in the reports above- hxxp://binclloudapp[.]com/466943in 1 report
- binclloudapp[.]comin 1 report
- 192.121.23[.]146in 1 report
- sectigoapps[.]comin 1 report
- solidclouaps[.]comin 1 report
- hxxps://marle[.]io/check/updprofile.aspxin 1 report
- marle[.]ioin 1 report
- www.ndibstersoft[.]comin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/AstarionRAT/win_mal_AstarionRAT.yarin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/Matanbuchus/win_mal_Matanbuchus_loader.yarin 1 report
- de81e2155d797ff7…0f62663f33b3in 1 report
- 6ffae128e0dbf14c…3c66ecc1ad1fin 1 report
- 68858d3cbc9b8aba…e853a47e3e31in 1 report
- 03c624d251e9143e…048a0967a829in 1 report
- 8e54cd12591d67df…f9e3c71fb925in 1 report
- c31c8edbf94c85cc…e5406d80df12in 1 report
- eecc83add16f3d51…0afb64d1d2afin 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.