qakbot | c888b058cd85352ec803eb2a6e78bef567b844e9982176efbcd7074982a760de

Resubmissions

19/05/2020, 13:04

200519-7d9ja2krwe10

19/05/2020, 12:28

200519-4h8rvftfme8

Sharing

Copy URL Twitter E-mail

General

Target
Darlehensvertrag_42816504192_15052020.vbs
Size 36.2MB
Sample200519-7d9ja2krwe
SHA256 c888b058cd85352ec803eb2a6e78bef567b844e9982176efbcd7074982a760de
MD5 e44fb6c9a050ae7ef4b55cce6a71cdcd
SHA1 dd77b217e503fddaf28bb60b6e3280a692807976
SHA512 9524cdd296cb89eb1cc8a160a62337a908990aa1e6d84b0e51c1827bec705331f458c0713d64cfe221a55ad32331db74a8e9ff4a356d6b2fb515b464e3804ab5
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Botnet

spx121

Campaign

1589802571

72.209.191.27:443
72.204.242.138:443
47.202.98.230:443
72.204.242.138:465
96.35.170.82:2222
96.56.237.174:465
65.60.228.130:443
76.187.8.160:443
79.101.206.85:995
64.19.74.29:995
84.117.60.157:443
94.176.128.176:443
72.204.242.138:32102
187.155.61.44:443
72.204.242.138:443
73.163.242.114:443
86.127.7.148:21
76.187.97.98:2222
82.178.63.31:443
174.52.64.212:443
68.174.15.223:443
89.137.162.193:443
24.183.39.93:443
104.50.141.139:995
98.219.77.197:443
72.204.242.138:53
207.255.161.8:32102
1.40.42.4:443
70.183.127.6:995
74.33.69.208:443
66.222.88.126:995
47.152.210.233:443
5.107.144.131:2222
39.32.30.170:993
70.57.15.187:993
63.155.158.242:995
76.170.77.99:443
97.127.144.203:2222
74.215.201.122:443
95.77.144.238:443
72.204.242.138:50003
71.220.191.200:443
67.83.54.76:2222
73.214.231.2:443
68.1.171.93:443
97.119.244.150:443
201.183.224.74:443
75.183.135.48:443
79.118.105.207:443
78.97.207.104:443
65.131.40.143:995
69.92.54.95:995
216.201.162.158:443
78.188.109.130:443
185.219.83.73:443
203.33.139.134:443
41.228.208.39:443
67.209.195.198:3389
208.126.142.17:443
72.218.167.183:995
184.98.104.7:995
72.204.242.138:6881
24.55.152.50:995
210.61.141.92:443
108.58.9.238:993
94.53.92.42:443
35.142.12.163:2222
199.116.241.147:443
71.43.165.10:995
81.196.235.231:443
71.77.252.14:2222
68.204.164.222:443
98.22.234.245:443
76.14.129.53:2222
216.163.4.91:443
179.14.167.91:443
75.87.161.32:995
172.78.87.180:443
74.56.167.31:443
119.95.109.155:2222
117.216.180.195:443
72.204.242.138:993
72.204.242.138:993
50.244.112.10:443
207.255.161.8:995
188.173.214.88:443
174.34.67.106:2222
188.25.231.229:443
39.36.52.207:995
61.1.206.23:443
203.213.104.25:995
24.201.79.208:2078
24.99.180.247:443
184.21.151.81:995
197.50.133.40:443
41.232.226.134:995
5.194.189.247:443
102.41.189.65:995
79.115.170.24:2222
72.224.213.98:2222
95.77.204.208:443
176.252.160.192:443
66.208.105.6:443
184.164.160.157:995
98.118.156.172:443
64.121.114.87:443
107.5.252.194:443
188.173.70.18:443
72.132.249.144:995
80.14.209.42:2222
5.12.252.196:443
61.3.184.206:443
173.81.27.199:443
71.213.29.14:995
49.191.9.180:995
50.247.230.33:995
137.99.224.198:443
71.182.142.63:443
50.78.93.74:443
24.110.96.149:443
47.180.66.10:443
50.104.186.71:443
210.195.170.222:443
104.36.135.227:443
108.51.73.186:443
24.234.86.201:995
47.41.3.40:443
24.43.22.220:995
72.16.212.108:465
84.117.89.128:443
24.27.82.216:2222
75.183.171.155:3389
47.205.231.60:443
66.26.160.37:443
96.56.237.174:993
24.46.40.189:2222
173.79.220.156:443
189.231.211.149:443
47.146.169.85:443
98.115.138.61:443
65.71.77.90:443
50.29.181.193:995
216.110.249.252:2222
68.60.221.169:465
71.187.170.235:443
47.153.115.154:995
197.166.118.115:443
50.244.112.106:443
24.122.228.88:443
96.37.137.42:443

Targets

- Target
  Darlehensvertrag_42816504192_15052020.vbs
- Size 36.2MB
- SHA256 c888b058cd85352ec803eb2a6e78bef567b844e9982176efbcd7074982a760de
- MD5 e44fb6c9a050ae7ef4b55cce6a71cdcd
- SHA1 dd77b217e503fddaf28bb60b6e3280a692807976
- SHA512 9524cdd296cb89eb1cc8a160a62337a908990aa1e6d84b0e51c1827bec705331f458c0713d64cfe221a55ad32331db74a8e9ff4a356d6b2fb515b464e3804ab5
- MD5 SHA1 SHA512
Score

10^/10

evasion trojan banker stealer qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Blacklisted process makes network request
- Executes dropped EXE
- Turns off Windows Defender SpyNet reporting
- Loads dropped DLL
- Windows security modification
  evasion trojan
behavioral1