krzcfi.exe

Target

krzcfi.exe

Size

1MB

Sample

201123-e4hnmc2mpx

Score

10 ^/10

MD5

3142cb390e6f2c895ed414cbd6b29c6d

SHA1

e61c794f7f825413ec4836b9f683b4265d98f142

SHA256

4ef522d3426001395a3acbdb2037cb3f8f79a91fc0ebfe235fac386d6b12257d

SHA512

4f4ddc24e8352005c5d9de6f11ddb13277596f67484b8db3213e1f7565002891930c92c1a216d55891d8a35882256041b14917fadbf69d21c94743ff8cf8d003

Extracted

Family	qakbot
Botnet	notset
Campaign	1604404534
C2	67.6.55.77:443 89.136.39.108:443 2.50.58.76:443 188.25.158.61:443 45.63.107.192:995 45.32.154.10:443 94.52.160.116:443 45.63.107.192:2222 45.63.107.192:443 72.204.242.138:465 84.117.176.32:443 95.77.223.148:443 47.146.39.147:443 41.225.13.128:8443 80.14.209.42:2222 190.220.8.10:995 66.76.105.194:443 105.101.69.242:443 89.33.87.107:443 75.136.40.155:443 78.97.3.6:443 108.46.145.30:443 68.134.181.98:443 85.121.42.12:995 75.87.161.32:995 68.174.15.223:443 149.28.99.97:995 199.247.16.80:443 45.32.155.12:443 149.28.99.97:2222 149.28.99.97:443 70.168.130.172:995 93.86.252.177:995 50.244.112.10:995 59.99.36.238:443 185.246.9.69:995 208.99.100.129:443 41.97.25.63:443 72.186.1.237:443 59.99.36.241:443 45.32.155.12:2222 96.30.198.161:443 140.82.27.132:443 45.32.165.134:443 45.63.104.123:443 207.246.70.216:443 97.118.38.31:993 134.228.24.29:443 188.25.24.21:2222 2.89.17.127:995 72.82.15.220:443 174.62.13.151:443 120.150.60.189:995 80.195.103.146:2222 142.129.227.86:443 89.137.221.232:443 98.26.50.62:995 74.129.26.119:443 146.199.132.233:2222 77.27.174.49:995 172.114.116.226:995 95.179.247.224:443 189.231.189.64:443 45.32.155.12:995 45.32.162.253:443 199.247.22.145:443 35.134.202.234:443 184.98.97.227:995 85.122.141.42:995 89.137.211.239:443 72.16.56.171:443 72.28.255.159:995 47.44.217.98:443 189.183.206.170:995 64.185.5.157:443 202.141.244.118:995 72.209.191.27:443 86.122.18.250:443 141.158.47.123:443 203.198.96.164:443 173.245.152.231:443 95.77.144.238:443 41.228.227.124:443 67.78.151.218:2222 84.232.238.30:443 188.27.32.167:443 173.3.17.223:995 201.215.96.174:0 69.11.247.242:443 87.65.204.240:995 207.246.75.201:443 217.162.149.212:443 45.77.193.83:443 80.240.26.178:443 98.16.204.189:995 173.90.33.182:2222 103.206.112.234:443 72.36.59.46:2222 190.220.8.10:443 86.98.89.245:2222 39.36.35.237:995 217.165.96.127:990 151.73.112.197:443 79.113.119.125:443 2.50.110.49:2078 72.66.47.70:443 93.113.177.152:443 103.238.231.35:443 78.97.207.104:443 156.213.227.208:443 71.163.223.253:443 108.31.15.10:995 184.21.136.237:443 184.179.14.130:22 81.133.234.36:2222 74.75.216.202:443 2.51.247.69:995 96.243.35.201:443 46.53.16.93:443 217.165.2.92:995 37.106.7.143:443 203.106.195.67:443 172.91.19.192:443 2.7.202.106:2222 78.96.199.79:443 184.55.32.182:443 24.205.42.241:443 103.76.160.110:443 188.121.219.88:2222 79.113.208.68:443 85.204.189.105:443 50.96.234.132:995 31.5.21.66:443 66.215.32.224:443 81.97.154.100:443 47.185.140.236:80 108.30.125.94:443 188.247.252.243:443 69.47.26.41:443 74.195.88.59:443 95.76.27.6:443 68.46.142.48:995 73.200.219.143:443 173.173.1.164:443 24.40.173.134:443 173.21.10.71:2222 73.225.67.0:443 45.47.65.191:443 75.106.52.142:443 75.182.220.196:2222 67.6.55.77:443 89.136.39.108:443 2.50.58.76:443 188.25.158.61:443 45.63.107.192:995 45.32.154.10:443 94.52.160.116:443 45.63.107.192:2222 45.63.107.192:443 72.204.242.138:465 84.117.176.32:443 95.77.223.148:443 47.146.39.147:443 41.225.13.128:8443 80.14.209.42:2222 190.220.8.10:995 66.76.105.194:443 105.101.69.242:443 89.33.87.107:443 75.136.40.155:443 78.97.3.6:443 108.46.145.30:443 68.134.181.98:443 85.121.42.12:995 75.87.161.32:995 68.174.15.223:443 149.28.99.97:995 199.247.16.80:443 45.32.155.12:443 149.28.99.97:2222 149.28.99.97:443 70.168.130.172:995 93.86.252.177:995 50.244.112.10:995 59.99.36.238:443 185.246.9.69:995 208.99.100.129:443 41.97.25.63:443 72.186.1.237:443 59.99.36.241:443 45.32.155.12:2222 96.30.198.161:443 140.82.27.132:443 45.32.165.134:443 45.63.104.123:443 207.246.70.216:443 97.118.38.31:993 134.228.24.29:443 188.25.24.21:2222 2.89.17.127:995 72.82.15.220:443 174.62.13.151:443 120.150.60.189:995 80.195.103.146:2222 142.129.227.86:443 89.137.221.232:443 98.26.50.62:995 74.129.26.119:443 146.199.132.233:2222 77.27.174.49:995 172.114.116.226:995 95.179.247.224:443 189.231.189.64:443 45.32.155.12:995 45.32.162.253:443 199.247.22.145:443 35.134.202.234:443 184.98.97.227:995 85.122.141.42:995 89.137.211.239:443 72.16.56.171:443 72.28.255.159:995 47.44.217.98:443 189.183.206.170:995 64.185.5.157:443 202.141.244.118:995 72.209.191.27:443 86.122.18.250:443 141.158.47.123:443 203.198.96.164:443 173.245.152.231:443 95.77.144.238:443 41.228.227.124:443 67.78.151.218:2222 84.232.238.30:443 188.27.32.167:443 173.3.17.223:995 201.215.96.174:0 69.11.247.242:443 87.65.204.240:995 207.246.75.201:443 217.162.149.212:443 45.77.193.83:443 80.240.26.178:443 98.16.204.189:995 173.90.33.182:2222 103.206.112.234:443 72.36.59.46:2222 190.220.8.10:443 86.98.89.245:2222 39.36.35.237:995 217.165.96.127:990 151.73.112.197:443 79.113.119.125:443 2.50.110.49:2078 72.66.47.70:443 93.113.177.152:443 103.238.231.35:443 78.97.207.104:443 156.213.227.208:443 71.163.223.253:443 108.31.15.10:995 184.21.136.237:443 184.179.14.130:22 81.133.234.36:2222 74.75.216.202:443 2.51.247.69:995 96.243.35.201:443 46.53.16.93:443 217.165.2.92:995 37.106.7.143:443 203.106.195.67:443 172.91.19.192:443 2.7.202.106:2222 78.96.199.79:443 184.55.32.182:443 24.205.42.241:443 103.76.160.110:443 188.121.219.88:2222 79.113.208.68:443 85.204.189.105:443 50.96.234.132:995 31.5.21.66:443 66.215.32.224:443 81.97.154.100:443 47.185.140.236:80 108.30.125.94:443 188.247.252.243:443 69.47.26.41:443 74.195.88.59:443 95.76.27.6:443 68.46.142.48:995 73.200.219.143:443 173.173.1.164:443 24.40.173.134:443 173.21.10.71:2222 73.225.67.0:443 45.47.65.191:443 75.106.52.142:443 75.182.220.196:2222

Target

krzcfi.exe

MD5

3142cb390e6f2c895ed414cbd6b29c6d

Filesize

1MB

Score

10 ^/10

SHA1

e61c794f7f825413ec4836b9f683b4265d98f142

SHA256

4ef522d3426001395a3acbdb2037cb3f8f79a91fc0ebfe235fac386d6b12257d

SHA512

4f4ddc24e8352005c5d9de6f11ddb13277596f67484b8db3213e1f7565002891930c92c1a216d55891d8a35882256041b14917fadbf69d21c94743ff8cf8d003

Signatures

Qakbot/Qbot

Description

Qbot or Qakbot is a sophisticated worm with banking capabilities.

Tags

trojan banker stealer qakbot
Executes dropped EXE
Loads dropped DLL

Related Tasks

behavioral1

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Scheduled Task

Privilege Escalation

static1

behavioral1

qakbot notset 1604404534 banker stealer trojan

10^/10

Extracted

Tags

Signatures

Qakbot/Qbot

Description

Tags

Executes dropped EXE

Loads dropped DLL

Related Tasks

static1

behavioral1