qakbot | 8393a4adfc52b82181fc5008601df84de01dd48cbb539d06a006eb93d271eb3d

General

Target

catalog-138717734.xlsm
Size

120KB
Sample

210415-t7bb822f6e
MD5

23723cbba5a0c4a19cd6bbf91f884f7c
SHA1

8ac83c33d6696122abfdaca85b16cbc2a44b06e3
SHA256

8393a4adfc52b82181fc5008601df84de01dd48cbb539d06a006eb93d271eb3d
SHA512

7821fdb964dad65b10920d987f03b6c7bfb7e1415c617c5d5586ef852ac24c0966f84276c5d95194adbd926bcead6843c9df6cce55ea90f871f73237ec5301f9

Score

10^/10

qakbot tr 1618398298 banker macro stealer trojan xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://boehm-kavon15lc.ru.com/body.html

xlm40.dropper

http://rosenbaum-milan15y.ru.com/body.html

xlm40.dropper

https://glsiba.org/drms/body.html

xlm40.dropper

https://jahthroneafricancrafts.com/drms/body.html

Extracted

Family

qakbot

Botnet

tr

Campaign

1618398298

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Targets

- Target
  
  catalog-138717734.xlsm
- Size
  
  120KB
- MD5
  
  23723cbba5a0c4a19cd6bbf91f884f7c
- SHA1
  
  8ac83c33d6696122abfdaca85b16cbc2a44b06e3
- SHA256
  
  8393a4adfc52b82181fc5008601df84de01dd48cbb539d06a006eb93d271eb3d
- SHA512
  
  7821fdb964dad65b10920d987f03b6c7bfb7e1415c617c5d5586ef852ac24c0966f84276c5d95194adbd926bcead6843c9df6cce55ea90f871f73237ec5301f9
Score

10^/10

qakbot tr 1618398298 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2