pbcvsz.exe

Target

pbcvsz.exe

Size

1MB

Sample

201123-v6xhtcaagn

Score

10 ^/10

MD5

07c94265420ec989c7201e928f77a9c8

SHA1

a588f191aef302db80609d0cbc780fca7bee0eb4

SHA256

36e22f2ab7fc577ff77aa8284d770efb6520e24b737424594fb9f6c5b824bc8c

SHA512

2cd2e3475d2b0d1d5df8a503773796af77d6be05eb45e5a8d806bb6e98524e5606614928cdc79d92afe89a57a0ee75471d7794ce596a8fbc96685083296157bc

Extracted

Family	qakbot
Botnet	notset
Campaign	1604404534
Credentials	Protocol: ftp Host: 192.185.5.208 Port: 21 Username: logger@dustinkeeling.com Password: NxdkxAp4dUsY Protocol: ftp Host: 162.241.218.118 Port: 21 Username: logger@misterexterior.com Password: EcOV0DyGVgVN Protocol: ftp Host: 69.89.31.139 Port: 21 Username: cpanel@vivekharris-architects.com Password: fcR7OvyLrMW6! Protocol: ftp Host: 169.207.67.14 Port: 21 Username: cpanel@dovetailsolar.com Password: eQyicNLzzqPN
C2	67.6.55.77:443 89.136.39.108:443 2.50.58.76:443 188.25.158.61:443 45.63.107.192:995 45.32.154.10:443 94.52.160.116:443 45.63.107.192:2222 45.63.107.192:443 72.204.242.138:465 84.117.176.32:443 95.77.223.148:443 47.146.39.147:443 41.225.13.128:8443 80.14.209.42:2222 190.220.8.10:995 66.76.105.194:443 105.101.69.242:443 89.33.87.107:443 75.136.40.155:443 78.97.3.6:443 108.46.145.30:443 68.134.181.98:443 85.121.42.12:995 75.87.161.32:995 68.174.15.223:443 149.28.99.97:995 199.247.16.80:443 45.32.155.12:443 149.28.99.97:2222 149.28.99.97:443 70.168.130.172:995 93.86.252.177:995 50.244.112.10:995 59.99.36.238:443 185.246.9.69:995 208.99.100.129:443 41.97.25.63:443 72.186.1.237:443 59.99.36.241:443 45.32.155.12:2222 96.30.198.161:443 140.82.27.132:443 45.32.165.134:443 45.63.104.123:443 207.246.70.216:443 97.118.38.31:993 134.228.24.29:443 188.25.24.21:2222 2.89.17.127:995 72.82.15.220:443 174.62.13.151:443 120.150.60.189:995 80.195.103.146:2222 142.129.227.86:443 89.137.221.232:443 98.26.50.62:995 74.129.26.119:443 146.199.132.233:2222 77.27.174.49:995 172.114.116.226:995 95.179.247.224:443 189.231.189.64:443 45.32.155.12:995 45.32.162.253:443 199.247.22.145:443 35.134.202.234:443 184.98.97.227:995 85.122.141.42:995 89.137.211.239:443 72.16.56.171:443 72.28.255.159:995 47.44.217.98:443 189.183.206.170:995 64.185.5.157:443 202.141.244.118:995 72.209.191.27:443 86.122.18.250:443 141.158.47.123:443 203.198.96.164:443 173.245.152.231:443 95.77.144.238:443 41.228.227.124:443 67.78.151.218:2222 84.232.238.30:443 188.27.32.167:443 173.3.17.223:995 201.215.96.174:0 69.11.247.242:443 87.65.204.240:995 207.246.75.201:443 217.162.149.212:443 45.77.193.83:443 80.240.26.178:443 98.16.204.189:995 173.90.33.182:2222 103.206.112.234:443 72.36.59.46:2222 190.220.8.10:443 86.98.89.245:2222 39.36.35.237:995 217.165.96.127:990 151.73.112.197:443 79.113.119.125:443 2.50.110.49:2078 72.66.47.70:443 93.113.177.152:443 103.238.231.35:443 78.97.207.104:443 156.213.227.208:443 71.163.223.253:443 108.31.15.10:995 184.21.136.237:443 184.179.14.130:22 81.133.234.36:2222 74.75.216.202:443 2.51.247.69:995 96.243.35.201:443 46.53.16.93:443 217.165.2.92:995 37.106.7.143:443 203.106.195.67:443 172.91.19.192:443 2.7.202.106:2222 78.96.199.79:443 184.55.32.182:443 24.205.42.241:443 103.76.160.110:443 188.121.219.88:2222 79.113.208.68:443 85.204.189.105:443 50.96.234.132:995 31.5.21.66:443 66.215.32.224:443 81.97.154.100:443 47.185.140.236:80 108.30.125.94:443 188.247.252.243:443 69.47.26.41:443 74.195.88.59:443 95.76.27.6:443 68.46.142.48:995 73.200.219.143:443 173.173.1.164:443 24.40.173.134:443 173.21.10.71:2222 73.225.67.0:443 45.47.65.191:443 75.106.52.142:443 75.182.220.196:2222 67.6.55.77:443 89.136.39.108:443 2.50.58.76:443 188.25.158.61:443 45.63.107.192:995 45.32.154.10:443 94.52.160.116:443 45.63.107.192:2222 45.63.107.192:443 72.204.242.138:465 84.117.176.32:443 95.77.223.148:443 47.146.39.147:443 41.225.13.128:8443 80.14.209.42:2222 190.220.8.10:995 66.76.105.194:443 105.101.69.242:443 89.33.87.107:443 75.136.40.155:443 78.97.3.6:443 108.46.145.30:443 68.134.181.98:443 85.121.42.12:995 75.87.161.32:995 68.174.15.223:443 149.28.99.97:995 199.247.16.80:443 45.32.155.12:443 149.28.99.97:2222 149.28.99.97:443 70.168.130.172:995 93.86.252.177:995 50.244.112.10:995 59.99.36.238:443 185.246.9.69:995 208.99.100.129:443 41.97.25.63:443 72.186.1.237:443 59.99.36.241:443 45.32.155.12:2222 96.30.198.161:443 140.82.27.132:443 45.32.165.134:443 45.63.104.123:443 207.246.70.216:443 97.118.38.31:993 134.228.24.29:443 188.25.24.21:2222 2.89.17.127:995 72.82.15.220:443 174.62.13.151:443 120.150.60.189:995 80.195.103.146:2222 142.129.227.86:443 89.137.221.232:443 98.26.50.62:995 74.129.26.119:443 146.199.132.233:2222 77.27.174.49:995 172.114.116.226:995 95.179.247.224:443 189.231.189.64:443 45.32.155.12:995 45.32.162.253:443 199.247.22.145:443 35.134.202.234:443 184.98.97.227:995 85.122.141.42:995 89.137.211.239:443 72.16.56.171:443 72.28.255.159:995 47.44.217.98:443 189.183.206.170:995 64.185.5.157:443 202.141.244.118:995 72.209.191.27:443 86.122.18.250:443 141.158.47.123:443 203.198.96.164:443 173.245.152.231:443 95.77.144.238:443 41.228.227.124:443 67.78.151.218:2222 84.232.238.30:443 188.27.32.167:443 173.3.17.223:995 201.215.96.174:0 69.11.247.242:443 87.65.204.240:995 207.246.75.201:443 217.162.149.212:443 45.77.193.83:443 80.240.26.178:443 98.16.204.189:995 173.90.33.182:2222 103.206.112.234:443 72.36.59.46:2222 190.220.8.10:443 86.98.89.245:2222 39.36.35.237:995 217.165.96.127:990 151.73.112.197:443 79.113.119.125:443 2.50.110.49:2078 72.66.47.70:443 93.113.177.152:443 103.238.231.35:443 78.97.207.104:443 156.213.227.208:443 71.163.223.253:443 108.31.15.10:995 184.21.136.237:443 184.179.14.130:22 81.133.234.36:2222 74.75.216.202:443 2.51.247.69:995 96.243.35.201:443 46.53.16.93:443 217.165.2.92:995 37.106.7.143:443 203.106.195.67:443 172.91.19.192:443 2.7.202.106:2222 78.96.199.79:443 184.55.32.182:443 24.205.42.241:443 103.76.160.110:443 188.121.219.88:2222 79.113.208.68:443 85.204.189.105:443 50.96.234.132:995 31.5.21.66:443 66.215.32.224:443 81.97.154.100:443 47.185.140.236:80 108.30.125.94:443 188.247.252.243:443 69.47.26.41:443 74.195.88.59:443 95.76.27.6:443 68.46.142.48:995 73.200.219.143:443 173.173.1.164:443 24.40.173.134:443 173.21.10.71:2222 73.225.67.0:443 45.47.65.191:443 75.106.52.142:443 75.182.220.196:2222

Target

pbcvsz.exe

MD5

07c94265420ec989c7201e928f77a9c8

Filesize

1MB

Score

10 ^/10

SHA1

a588f191aef302db80609d0cbc780fca7bee0eb4

SHA256

36e22f2ab7fc577ff77aa8284d770efb6520e24b737424594fb9f6c5b824bc8c

SHA512

2cd2e3475d2b0d1d5df8a503773796af77d6be05eb45e5a8d806bb6e98524e5606614928cdc79d92afe89a57a0ee75471d7794ce596a8fbc96685083296157bc

Signatures

Qakbot/Qbot

Description

Qbot or Qakbot is a sophisticated worm with banking capabilities.

Tags

trojan banker stealer qakbot
Executes dropped EXE
Loads dropped DLL

Related Tasks

behavioral1

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Scheduled Task

Privilege Escalation

static1

behavioral1

qakbot notset 1604404534 banker stealer trojan

10^/10

Extracted

Tags

Signatures

Qakbot/Qbot

Description

Tags

Executes dropped EXE

Loads dropped DLL

Related Tasks

static1

behavioral1