qakbot | 430d4980a1a19c9f7fdb203c395ef1a920f8595b0d93ae212fb526f9e9af1fd4

General

Target

catalog-1746358838.xlsm
Size

120KB
Sample

210415-9w7m23sjfn
MD5

f7604fd53f0c0e2ba5f1e688f85d6d38
SHA1

4e179d4689b4d3760bbff69f3493a7802d8b9259
SHA256

430d4980a1a19c9f7fdb203c395ef1a920f8595b0d93ae212fb526f9e9af1fd4
SHA512

9079aefe98413f2af951dd0f787d7e4f3186e6a8ec59f16b7d19714fab48174da841f68a7204dffbb00413efacdef710621e31318791d48214309988f3835b41

Score

10^/10

qakbot tr 1618398298 banker macro stealer trojan xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://boehm-kavon15lc.ru.com/body.html

xlm40.dropper

http://rosenbaum-milan15y.ru.com/body.html

xlm40.dropper

https://glsiba.org/drms/body.html

xlm40.dropper

https://jahthroneafricancrafts.com/drms/body.html

Extracted

Family

qakbot

Botnet

tr

Campaign

1618398298

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Targets

- Target
  
  catalog-1746358838.xlsm
- Size
  
  120KB
- MD5
  
  f7604fd53f0c0e2ba5f1e688f85d6d38
- SHA1
  
  4e179d4689b4d3760bbff69f3493a7802d8b9259
- SHA256
  
  430d4980a1a19c9f7fdb203c395ef1a920f8595b0d93ae212fb526f9e9af1fd4
- SHA512
  
  9079aefe98413f2af951dd0f787d7e4f3186e6a8ec59f16b7d19714fab48174da841f68a7204dffbb00413efacdef710621e31318791d48214309988f3835b41
Score

10^/10

qakbot tr 1618398298 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2