General

  • Target
    5932c8742b819a8112fabdc0b9db1811
  • Size 217KB
  • Sample200520-6dennfkhza
  • SHA256 4bd9bde3970fb7ae3fefb0c70d36a4e1da7ef94b4fb0cb7b867835bbc7373d98
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • qakbot

Botnet
  • spx123

Campaign
  • 1589977350

C2
  • 71.77.252.14:2222

  • 174.130.225.61:443

  • 76.187.97.98:2222

  • 187.19.151.218:995

  • 82.127.193.151:2222

  • 72.204.242.138:993

  • 72.204.242.138:993

  • 66.208.105.6:443

  • 24.183.39.93:443

  • 98.243.187.85:443

  • 68.49.120.179:443

  • 72.204.242.138:995

  • 72.29.181.77:2078

  • 72.204.242.138:443

  • 24.136.33.120:2222

  • 96.56.237.174:990

  • 107.2.148.99:443

  • 216.201.162.158:443

  • 71.213.29.14:995

  • 84.247.55.190:443

Targets

    • Target
      Darlehensvertrag_237886470423_19052020.vbs
    • Size 36.3MB
    • SHA256 dfacae17a54e54e9b25d77399619859ed6b196318bd06341c22c7a8b4a090254
    • MD5 SHA1 SHA512
    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks