dc2f4aa039a9cee3225a8ab40bf91d5a3059ba4381dbd8b7ebf9b9dba4834286

General
Target

dc2f4aa039a9cee3225a8ab40bf91d5a3059ba4381dbd8b7ebf9b9dba4834286

Size

1MB

Sample

210418-g9da8lsjpj

Score
10 /10
MD5

9f04abc85aca9e32b8886ab0a68be90f

SHA1

0a881779b176ae84e981e87b99f23f95372a5da8

SHA256

dc2f4aa039a9cee3225a8ab40bf91d5a3059ba4381dbd8b7ebf9b9dba4834286

SHA512

05d1d73492b3fd137827585b7082795fa99c7c7fabcab81da814f53b768f389b05a9c578e557eed7e70ae6257dae23d34aca54489deeb7cc5f10ecc9426fb28d

Malware Config

Extracted

Family qakbot
Botnet notset
Campaign 1618398961
C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

45.32.211.207:8443

144.202.38.185:2222

144.202.38.185:995

149.28.101.90:995

149.28.101.90:8443

149.28.101.90:443

149.28.101.90:2222

45.77.115.208:443

45.77.115.208:995

207.246.77.75:995

207.246.77.75:443

207.246.77.75:2222

207.246.77.75:8443

207.246.116.237:443

207.246.116.237:8443

207.246.116.237:2222

45.77.117.108:995

45.77.117.108:2222

45.77.117.108:8443

195.6.1.154:2222

105.198.236.101:443

105.198.236.99:443

188.26.91.212:443

81.97.154.100:443

78.63.226.32:443

45.63.107.192:995

149.28.99.97:2222

115.133.243.6:443

27.223.92.142:995

76.25.142.196:443

Targets
Target

dc2f4aa039a9cee3225a8ab40bf91d5a3059ba4381dbd8b7ebf9b9dba4834286

MD5

9f04abc85aca9e32b8886ab0a68be90f

Filesize

1MB

Score
10 /10
SHA1

0a881779b176ae84e981e87b99f23f95372a5da8

SHA256

dc2f4aa039a9cee3225a8ab40bf91d5a3059ba4381dbd8b7ebf9b9dba4834286

SHA512

05d1d73492b3fd137827585b7082795fa99c7c7fabcab81da814f53b768f389b05a9c578e557eed7e70ae6257dae23d34aca54489deeb7cc5f10ecc9426fb28d

Tags

Signatures

  • Qakbot/Qbot

    Description

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    Tags

  • Suspicious use of NtCreateProcessExOtherParentProcess

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation