qakbot | 2e774230640debe52a0ff7f4aa9ccdc5b2b271192492b773b41b827ef41f4674

Sharing

Copy URL Twitter E-mail

General

Target
Kaufvertrag_3103078_21052020.zip
Size 186KB
Sample200525-ddd1ggsbdj
SHA256 2e774230640debe52a0ff7f4aa9ccdc5b2b271192492b773b41b827ef41f4674
MD5 bbbf7ba98f5cca9068f56109a6dd986b
SHA1 7239e35de90e64d1f94698f334edff15aa18a4d3
SHA512 9c519a6b79dcb201261f649c0b29dae8d633ffe0b9fa3b501f8f684193348a9a4156c528e06be09c0335856f00e99f0c02ff9cb32447d1ce8dcbdcf444547ffc
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Botnet

spx125

Campaign

1590138228

190.75.168.108:2078
93.114.192.211:2222
47.39.76.74:443
182.56.134.44:995
24.201.79.208:2078
207.246.71.122:443
50.244.112.10:443
88.207.27.144:443
72.204.242.138:443
72.204.242.138:2078
72.204.242.138:990
76.187.8.160:443
220.135.31.140:2222
86.126.97.183:2222
86.126.112.153:995
68.49.120.179:443
101.108.125.44:443
203.101.163.187:443
197.165.212.10:443
207.255.161.8:2078
207.255.161.8:995
98.243.187.85:443
207.255.161.8:32103
108.227.161.27:995
189.140.112.184:443
172.78.87.180:443
71.205.158.156:443
72.28.255.159:995
68.39.177.147:995
73.94.229.115:443
108.58.9.238:995
1.40.42.4:443
74.33.69.208:443
66.222.88.126:995
72.204.242.138:53
24.99.180.247:443
47.152.210.233:443
24.10.42.174:443
140.82.21.191:443
72.190.101.70:443
78.188.109.130:443
211.24.72.253:443
70.124.29.226:443
71.241.247.189:443
216.201.162.158:443
24.43.22.220:993
46.214.139.81:443
49.191.9.180:995
75.183.135.48:443
47.153.115.154:995
50.247.230.33:995
70.183.127.6:995
76.170.77.99:443
188.26.98.35:443
66.68.22.151:443
137.99.224.198:443
75.81.25.223:443
97.127.144.203:2222
76.111.128.194:443
50.78.93.74:443
171.97.10.201:2222
72.204.242.138:50003
67.170.137.8:443
24.122.228.88:443
72.186.1.237:443
189.159.148.145:995
203.106.195.139:443
100.12.173.247:995
98.121.187.78:443
79.78.131.124:443
98.116.62.242:443
89.137.215.100:443
173.245.152.231:443
68.204.164.222:443
217.162.149.212:443
95.77.223.168:443
72.132.249.144:995
79.114.196.138:443
85.122.141.42:443
188.173.70.18:443
117.217.231.113:443
47.202.98.230:443
80.14.209.42:2222
103.76.160.110:443
210.195.177.30:443
24.226.137.154:443
50.244.112.106:443
172.242.156.50:443
5.107.239.212:2222
81.133.234.36:2222
79.116.237.126:443
77.237.188.30:995
5.12.214.109:2222
174.130.225.61:443
102.41.118.44:995
197.50.133.40:443
84.117.176.32:443
24.202.42.48:2222
98.32.60.217:443
72.16.212.108:465
67.250.184.157:443
85.186.50.42:443
98.16.204.189:995
154.56.64.21:443
99.196.208.15:443
72.204.242.138:995
72.29.181.77:2078
72.240.245.253:443
96.56.237.174:990
47.40.244.237:443
100.4.173.223:443
71.213.29.14:995
65.100.244.179:2083
173.90.33.182:2222
104.36.135.227:443
173.175.29.210:443
102.190.246.65:6881
68.4.137.211:443
61.3.126.96:443
188.25.233.157:2222
82.79.67.68:443
73.163.242.114:443
100.38.123.22:443
96.18.240.158:443
71.8.33.238:443
5.182.39.156:443
199.116.241.147:443
94.10.81.239:443
104.221.4.11:2222
184.180.157.203:2222
82.210.157.185:443
65.60.228.130:443
96.56.237.174:465
72.204.242.138:50001
67.165.206.193:995
75.87.161.32:995
64.19.74.29:995
72.204.242.138:32102
187.155.67.97:443
68.174.15.223:443
176.223.114.184:443
197.210.96.222:995
71.77.252.14:2222
46.214.62.199:443
71.185.60.227:443
68.207.50.2:443
108.27.217.44:443
74.134.46.7:443

Extracted

Family

qakbot

Botnet

notset

Campaign

1588850855

Credentials

Protocol
ftp
Host
192.185.5.208
Port
21
Username
[email protected]
Password
NxdkxAp4dUsY

Credentials

Protocol
ftp
Host
162.241.218.118
Port
21
Username
[email protected]
Password
EcOV0DyGVgVN

Credentials

Protocol
ftp
Host
69.89.31.139
Port
21
Username
[email protected]
Password
fcR7OvyLrMW6!

Credentials

Protocol
ftp
Host
169.207.67.14
Port
21
Username
[email protected]
Password
eQyicNLzzqPN

24.110.14.40:443
96.35.170.82:2222
50.78.93.74:443
76.187.97.98:2222
202.77.4.37:443
89.38.171.30:443
66.26.160.37:443
58.108.188.231:443
67.83.54.76:2222
102.41.116.213:995
78.96.245.58:443
176.193.14.165:2222
73.1.68.242:443
96.37.113.36:443
98.22.234.245:443
76.15.41.32:443
95.77.235.132:0
24.226.137.154:443
24.99.180.247:443
24.43.22.220:995
41.228.192.103:443
96.37.137.42:443
97.78.107.14:443
70.120.149.173:443
96.41.93.96:443
207.255.94.98:443
63.230.2.205:2083
216.152.7.12:443
97.96.51.117:443
72.240.124.46:443
173.3.132.17:995
178.236.108.131:443
47.138.200.85:443
207.255.161.8:443
75.81.25.223:995
100.38.123.22:443
84.117.176.32:443
80.14.209.42:2222
67.165.206.193:995
47.153.115.154:443
104.36.135.227:443
173.173.68.41:443
86.126.50.168:21
100.40.48.96:443
47.205.231.60:443
216.201.162.158:443
108.185.108.124:443
47.202.98.230:443
68.174.15.223:443
47.17.70.45:443
188.115.130.128:443
68.1.171.93:443
79.118.188.252:443
72.204.242.138:990
75.110.93.212:443
134.19.208.152:443
72.204.242.138:2078
108.31.85.191:1194
63.155.71.107:995
86.124.13.37:443
71.77.231.251:443
172.95.42.35:443
65.116.179.83:443
184.21.151.81:995
72.204.242.138:993
64.121.114.87:443
100.37.33.10:443
72.204.242.138:50003
24.202.42.48:2222
142.129.227.86:443
207.255.161.8:2078
108.27.217.44:443
72.204.242.138:53
46.214.152.89:443
82.77.177.33:443
31.5.168.31:443
107.5.252.194:443
5.15.62.250:443
65.131.110.141:995
41.97.159.163:443
24.88.76.111:443
86.127.144.244:2222
98.118.156.172:443
24.203.36.180:2222
78.97.145.242:443
203.213.104.25:995
71.88.104.107:443
89.45.102.218:2222
89.44.194.21:443
65.60.228.130:443
72.204.242.138:465
70.57.15.187:993
64.19.74.29:995
75.183.171.155:3389
81.103.144.77:443
134.0.196.46:995
24.67.37.137:443
49.191.9.180:995
71.163.225.75:443
50.247.230.33:995
72.204.242.138:443
137.99.224.198:443
67.131.59.17:443
72.190.101.70:443
83.25.18.252:2222
24.201.79.208:2078
72.45.14.185:443
182.56.134.44:995
50.246.229.50:443
50.104.186.71:443
121.74.205.27:995
199.241.223.66:443
92.5.146.37:2222
72.16.212.107:465
188.26.150.82:2222
98.32.60.217:443
67.209.195.198:3389
110.142.29.212:443
203.33.139.134:443
24.46.40.189:2222
68.49.120.179:443
98.115.138.61:443
79.119.126.161:443
47.40.244.237:443
24.27.82.216:2222
116.202.36.62:21
71.187.170.235:443
216.163.4.91:443
75.87.161.32:995
188.247.252.236:443
71.77.252.14:2222
69.123.179.70:443
94.53.92.42:443
118.174.167.6:443
173.175.29.210:443
201.215.29.153:443
86.22.41.176:443
72.209.191.27:443
94.52.160.116:443
74.75.237.11:443
93.114.246.67:443
72.204.242.138:32102
156.222.109.244:995
76.170.77.99:443
50.108.212.180:443
108.227.161.27:995
67.170.137.8:443
50.244.112.10:443

Targets

- Target
  Kaufvertrag_648230011400_21052020.vbs
- Size 36.3MB
- SHA256 bfca22cf77eb45df30fa08fa3995163683633919c30332d60d015eaf23544194
- MD5 86d77e33adbd08281bde87c925026219
- SHA1 62393354f0037c8f56ebc33606b43ee71de3079b
- SHA512 d1a0dc4c63e8e309366eb48bf9d124a546dfa689636880d968b80ddb92548f3d21043cd2fe22b8ea5673648c0ee1ee0c533323062579cd5bd7960a4a6e694368
- MD5 SHA1 SHA512
Score

10^/10

qakbot notset spx125 1588850855 1590138228 banker cryptone evasion packer persistence stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Turns off Windows Defender SpyNet reporting
  evasion
- Windows security bypass
  evasion trojan
- CryptOne packer
  Detects CryptOne packer defined in NCC blogpost.
  cryptone packer
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1