qakbot | e443c61de95ddab96eb2f2658ace7b6d9b03dc3b9b37068396ecd655eb543aec

General

Target

documents-1472621861.xlsb
Size

94KB
Sample

210414-3ktty5rt6n
MD5

7046115d4093bb8a33ae64df0a85c4dd
SHA1

602a43d4665ea83f3e1d0f1bc27ce83f515e6360
SHA256

e443c61de95ddab96eb2f2658ace7b6d9b03dc3b9b37068396ecd655eb543aec
SHA512

99c0183e937ab6a272fc4fda56eb4eac1e845d1f99a994290e3b380974e973be340b972d5d5186377f5448d949133b7e00790dbd05869b56bd2916c111dc1ef5

Score

10^/10

qakbot tr 1618398298 banker macro stealer trojan xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://theottomandoner.co.uk/drms/bb.html

xlm40.dropper

http://paufderhar07ol.ru.com/bb.html

xlm40.dropper

http://nicolette7107gq.ru.com/bb.html

xlm40.dropper

https://chocolateuncle.online/drms/bb.html

xlm40.dropper

https://cablenet.com.ec/drms/bb.html

Extracted

Family

qakbot

Botnet

tr

Campaign

1618398298

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Targets

- Target
  
  documents-1472621861.xlsb
- Size
  
  94KB
- MD5
  
  7046115d4093bb8a33ae64df0a85c4dd
- SHA1
  
  602a43d4665ea83f3e1d0f1bc27ce83f515e6360
- SHA256
  
  e443c61de95ddab96eb2f2658ace7b6d9b03dc3b9b37068396ecd655eb543aec
- SHA512
  
  99c0183e937ab6a272fc4fda56eb4eac1e845d1f99a994290e3b380974e973be340b972d5d5186377f5448d949133b7e00790dbd05869b56bd2916c111dc1ef5
Score

10^/10

qakbot tr 1618398298 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2