944db2ee2b1958a2740d0b5c0057c46f.dll

Target

Size

823KB

Sample

210920-v116xaefe8

Score

10 ^/10

MD5

944db2ee2b1958a2740d0b5c0057c46f

SHA1

b0804ed04064aed6c9b283629b3416b5aeac84fb

SHA256

095c41270ae3a26ae9efb626be12ed920c44432f3c8cc8ed8ee67d67425c1251

SHA512

786273bb4be3439fdf0f79021c043b1a95afe85444c5330ead4d93b5ad6c3484f546017e564b50b64609725df7be9071cc1eee9b3817035a36229423995b1343

Extracted

Family	qakbot
Version	402.318
Botnet	obama100
Campaign	1632151873
C2	45.46.53.140:2222 144.139.47.206:443 189.210.115.207:443 120.150.218.241:995 47.22.148.6:443 140.82.49.12:443 24.139.72.117:443 24.229.150.54:995 24.55.112.61:443 136.232.34.70:443 95.77.223.148:443 173.21.10.71:2222 76.25.142.196:443 96.37.113.36:993 71.74.12.34:443 73.151.236.31:443 67.165.206.193:993 109.12.111.14:443 68.204.7.158:443 105.198.236.99:443 75.188.35.168:443 216.201.162.158:443 196.218.227.241:995 185.250.148.74:2222 81.214.126.173:2222 68.186.192.69:443 72.252.201.69:443 92.59.35.196:2222 24.152.219.253:995 50.29.166.232:995 75.67.192.125:443 24.95.61.62:443 73.25.124.140:2222 27.223.92.142:995 64.121.114.87:443 151.205.102.42:443 72.240.200.181:2222 75.137.47.174:443 45.32.211.207:995 45.32.211.207:8443 149.28.98.196:2222 149.28.98.196:995 207.246.77.75:8443 45.63.107.192:995 149.28.99.97:443 45.77.117.108:2222 149.28.99.97:2222 45.32.211.207:2222 45.63.107.192:443 149.28.101.90:443 149.28.101.90:8443 149.28.99.97:995 96.253.46.210:443 83.196.56.65:2222 45.77.115.208:2222 45.77.115.208:8443 45.77.115.208:443 144.202.38.185:443 144.202.38.185:2222 45.32.211.207:443 144.202.38.185:995 149.28.98.196:443 149.28.101.90:2222 45.77.117.108:443 207.246.77.75:995 207.246.77.75:443 207.246.77.75:2222 149.28.101.90:995 45.77.117.108:995 45.77.117.108:8443 45.77.115.208:995 71.163.222.223:443 90.87.245.154:2222 207.246.116.237:995 207.246.116.237:443 45.63.107.192:2222 207.246.116.237:8443 207.246.116.237:2222 24.179.77.236:443 184.185.103.157:443 217.165.164.110:2222 213.122.113.120:443 193.248.221.184:2222 188.27.179.172:443 222.153.169.147:995 100.2.20.137:443 172.78.42.79:443 97.69.160.4:2222 105.198.236.101:443 98.192.185.86:443 186.144.33.73:443 96.61.23.88:995 86.220.60.247:2222 71.41.184.10:3389 175.143.92.16:443 46.149.81.250:443 98.252.118.134:443 92.96.3.180:2078 71.187.170.235:443 50.244.112.106:443 24.122.118.18:443 47.196.213.73:443 186.154.175.13:443 70.163.161.79:443 78.63.226.32:443 76.168.147.166:993 77.27.207.217:995 31.4.242.28:995 125.62.192.195:443 195.12.154.8:443 96.21.251.127:2222 71.199.192.62:443 70.168.130.172:995 82.12.157.95:995 209.210.187.52:995 209.210.187.52:443 67.6.12.4:443 189.222.59.177:443 174.104.22.30:443 142.117.191.18:2222 189.146.183.105:443 213.60.147.140:443 196.221.207.137:995 108.46.145.30:443 187.250.238.164:995 2.7.116.188:2222 195.43.173.70:443 106.250.150.98:443 45.67.231.247:443 83.110.103.152:443 83.110.9.71:2222 78.97.207.104:443 59.90.246.200:443 80.227.5.69:443 125.63.101.62:443 86.236.77.68:2222 109.106.69.138:2222 84.72.35.226:443 217.133.54.140:32100 197.161.154.132:443 89.137.211.239:995 74.222.204.82:995 122.148.156.131:995 156.223.110.23:443 144.139.166.18:443 202.185.166.181:443 76.94.200.148:995 71.63.120.101:443 196.151.252.84:443 202.188.138.162:443 45.46.53.140:2222 144.139.47.206:443 189.210.115.207:443 120.150.218.241:995 47.22.148.6:443 140.82.49.12:443 24.139.72.117:443 24.229.150.54:995 24.55.112.61:443 136.232.34.70:443 95.77.223.148:443 173.21.10.71:2222 76.25.142.196:443 96.37.113.36:993 71.74.12.34:443 73.151.236.31:443 67.165.206.193:993 109.12.111.14:443 68.204.7.158:443 105.198.236.99:443 75.188.35.168:443 216.201.162.158:443 196.218.227.241:995 185.250.148.74:2222 81.214.126.173:2222 68.186.192.69:443 72.252.201.69:443 92.59.35.196:2222 24.152.219.253:995 50.29.166.232:995 75.67.192.125:443 24.95.61.62:443 73.25.124.140:2222 27.223.92.142:995 64.121.114.87:443 151.205.102.42:443 72.240.200.181:2222 75.137.47.174:443 45.32.211.207:995 45.32.211.207:8443 149.28.98.196:2222 149.28.98.196:995 207.246.77.75:8443 45.63.107.192:995 149.28.99.97:443 45.77.117.108:2222 149.28.99.97:2222 45.32.211.207:2222 45.63.107.192:443 149.28.101.90:443 149.28.101.90:8443 149.28.99.97:995 96.253.46.210:443 83.196.56.65:2222 45.77.115.208:2222 45.77.115.208:8443 45.77.115.208:443 144.202.38.185:443 144.202.38.185:2222 45.32.211.207:443 144.202.38.185:995 149.28.98.196:443 149.28.101.90:2222 45.77.117.108:443 207.246.77.75:995 207.246.77.75:443 207.246.77.75:2222 149.28.101.90:995 45.77.117.108:995 45.77.117.108:8443 45.77.115.208:995 71.163.222.223:443 90.87.245.154:2222 207.246.116.237:995 207.246.116.237:443 45.63.107.192:2222 207.246.116.237:8443 207.246.116.237:2222 24.179.77.236:443 184.185.103.157:443 217.165.164.110:2222 213.122.113.120:443 193.248.221.184:2222 188.27.179.172:443 222.153.169.147:995 100.2.20.137:443 172.78.42.79:443 97.69.160.4:2222 105.198.236.101:443 98.192.185.86:443 186.144.33.73:443 96.61.23.88:995 86.220.60.247:2222 71.41.184.10:3389 175.143.92.16:443 46.149.81.250:443 98.252.118.134:443 92.96.3.180:2078 71.187.170.235:443 50.244.112.106:443 24.122.118.18:443 47.196.213.73:443 186.154.175.13:443 70.163.161.79:443 78.63.226.32:443 76.168.147.166:993 77.27.207.217:995 31.4.242.28:995 125.62.192.195:443 195.12.154.8:443 96.21.251.127:2222 71.199.192.62:443 70.168.130.172:995 82.12.157.95:995 209.210.187.52:995 209.210.187.52:443 67.6.12.4:443 189.222.59.177:443 174.104.22.30:443 142.117.191.18:2222 189.146.183.105:443 213.60.147.140:443 196.221.207.137:995 108.46.145.30:443 187.250.238.164:995 2.7.116.188:2222 195.43.173.70:443 106.250.150.98:443 45.67.231.247:443 83.110.103.152:443 83.110.9.71:2222 78.97.207.104:443 59.90.246.200:443 80.227.5.69:443 125.63.101.62:443 86.236.77.68:2222 109.106.69.138:2222 84.72.35.226:443 217.133.54.140:32100 197.161.154.132:443 89.137.211.239:995 74.222.204.82:995 122.148.156.131:995 156.223.110.23:443 144.139.166.18:443 202.185.166.181:443 76.94.200.148:995 71.63.120.101:443 196.151.252.84:443 202.188.138.162:443

Target

944db2ee2b1958a2740d0b5c0057c46f.dll

MD5

944db2ee2b1958a2740d0b5c0057c46f

Filesize

823KB

Score

10 ^/10

SHA1

b0804ed04064aed6c9b283629b3416b5aeac84fb

SHA256

095c41270ae3a26ae9efb626be12ed920c44432f3c8cc8ed8ee67d67425c1251

SHA512

786273bb4be3439fdf0f79021c043b1a95afe85444c5330ead4d93b5ad6c3484f546017e564b50b64609725df7be9071cc1eee9b3817035a36229423995b1343

Signatures

Qakbot/Qbot

Description

Qbot or Qakbot is a sophisticated worm with banking capabilities.

Tags

trojan banker stealer qakbot
Loads dropped DLL

Related Tasks

behavioral1 behavioral2

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Scheduled Task

Privilege Escalation

static1

behavioral1

qakbot obama100 1632151873 banker stealer trojan

10^/10

behavioral2

qakbot obama100 1632151873 banker stealer trojan

10^/10

Extracted

Tags

Signatures

Qakbot/Qbot

Description

Tags

Loads dropped DLL

Related Tasks

static1

behavioral1

behavioral2