44459.8061394676.dat

Target

Size

823KB

Sample

210920-vbamnahcgk

Score

10 ^/10

MD5

a372400cbff205def639e4db62ef17b4

SHA1

445447a8cd34df42d7fd786a164389cf8e5f82db

SHA256

63deda6fe8af221a650f6ba6a2ee6c7fec17f10bc5e063c9b0aaee4981a01150

SHA512

763807749271cf66fa935b4da272ede62543971e124680381af5f22dd20d48d7f297dfcfb441ad3e56b96902129428d925b89e37ebc745b62d641fe7802b5457

Extracted

Family	qakbot
Version	402.318
Botnet	obama100
Campaign	1632151873
C2	45.46.53.140:2222 144.139.47.206:443 189.210.115.207:443 120.150.218.241:995 47.22.148.6:443 140.82.49.12:443 24.139.72.117:443 24.229.150.54:995 24.55.112.61:443 136.232.34.70:443 95.77.223.148:443 173.21.10.71:2222 76.25.142.196:443 96.37.113.36:993 71.74.12.34:443 73.151.236.31:443 67.165.206.193:993 109.12.111.14:443 68.204.7.158:443 105.198.236.99:443 75.188.35.168:443 216.201.162.158:443 196.218.227.241:995 185.250.148.74:2222 81.214.126.173:2222 68.186.192.69:443 72.252.201.69:443 92.59.35.196:2222 24.152.219.253:995 50.29.166.232:995 75.67.192.125:443 24.95.61.62:443 73.25.124.140:2222 27.223.92.142:995 64.121.114.87:443 151.205.102.42:443 72.240.200.181:2222 75.137.47.174:443 45.32.211.207:995 45.32.211.207:8443 149.28.98.196:2222 149.28.98.196:995 207.246.77.75:8443 45.63.107.192:995 149.28.99.97:443 45.77.117.108:2222 149.28.99.97:2222 45.32.211.207:2222 45.63.107.192:443 149.28.101.90:443 149.28.101.90:8443 149.28.99.97:995 96.253.46.210:443 83.196.56.65:2222 45.77.115.208:2222 45.77.115.208:8443 45.77.115.208:443 144.202.38.185:443 144.202.38.185:2222 45.32.211.207:443 144.202.38.185:995 149.28.98.196:443 149.28.101.90:2222 45.77.117.108:443 207.246.77.75:995 207.246.77.75:443 207.246.77.75:2222 149.28.101.90:995 45.77.117.108:995 45.77.117.108:8443 45.77.115.208:995 71.163.222.223:443 90.87.245.154:2222 207.246.116.237:995 207.246.116.237:443 45.63.107.192:2222 207.246.116.237:8443 207.246.116.237:2222 24.179.77.236:443 184.185.103.157:443 217.165.164.110:2222 213.122.113.120:443 193.248.221.184:2222 188.27.179.172:443 222.153.169.147:995 100.2.20.137:443 172.78.42.79:443 97.69.160.4:2222 105.198.236.101:443 98.192.185.86:443 186.144.33.73:443 96.61.23.88:995 86.220.60.247:2222 71.41.184.10:3389 175.143.92.16:443 46.149.81.250:443 98.252.118.134:443 92.96.3.180:2078 71.187.170.235:443 50.244.112.106:443 24.122.118.18:443 47.196.213.73:443 186.154.175.13:443 70.163.161.79:443 78.63.226.32:443 76.168.147.166:993 77.27.207.217:995 31.4.242.28:995 125.62.192.195:443 195.12.154.8:443 96.21.251.127:2222 71.199.192.62:443 70.168.130.172:995 82.12.157.95:995 209.210.187.52:995 209.210.187.52:443 67.6.12.4:443 189.222.59.177:443 174.104.22.30:443 142.117.191.18:2222 189.146.183.105:443 213.60.147.140:443 196.221.207.137:995 108.46.145.30:443 187.250.238.164:995 2.7.116.188:2222 195.43.173.70:443 106.250.150.98:443 45.67.231.247:443 83.110.103.152:443 83.110.9.71:2222 78.97.207.104:443 59.90.246.200:443 80.227.5.69:443 125.63.101.62:443 86.236.77.68:2222 109.106.69.138:2222 84.72.35.226:443 217.133.54.140:32100 197.161.154.132:443 89.137.211.239:995 74.222.204.82:995 122.148.156.131:995 156.223.110.23:443 144.139.166.18:443 202.185.166.181:443 76.94.200.148:995 71.63.120.101:443 196.151.252.84:443 202.188.138.162:443 45.46.53.140:2222 144.139.47.206:443 189.210.115.207:443 120.150.218.241:995 47.22.148.6:443 140.82.49.12:443 24.139.72.117:443 24.229.150.54:995 24.55.112.61:443 136.232.34.70:443 95.77.223.148:443 173.21.10.71:2222 76.25.142.196:443 96.37.113.36:993 71.74.12.34:443 73.151.236.31:443 67.165.206.193:993 109.12.111.14:443 68.204.7.158:443 105.198.236.99:443 75.188.35.168:443 216.201.162.158:443 196.218.227.241:995 185.250.148.74:2222 81.214.126.173:2222 68.186.192.69:443 72.252.201.69:443 92.59.35.196:2222 24.152.219.253:995 50.29.166.232:995 75.67.192.125:443 24.95.61.62:443 73.25.124.140:2222 27.223.92.142:995 64.121.114.87:443 151.205.102.42:443 72.240.200.181:2222 75.137.47.174:443 45.32.211.207:995 45.32.211.207:8443 149.28.98.196:2222 149.28.98.196:995 207.246.77.75:8443 45.63.107.192:995 149.28.99.97:443 45.77.117.108:2222 149.28.99.97:2222 45.32.211.207:2222 45.63.107.192:443 149.28.101.90:443 149.28.101.90:8443 149.28.99.97:995 96.253.46.210:443 83.196.56.65:2222 45.77.115.208:2222 45.77.115.208:8443 45.77.115.208:443 144.202.38.185:443 144.202.38.185:2222 45.32.211.207:443 144.202.38.185:995 149.28.98.196:443 149.28.101.90:2222 45.77.117.108:443 207.246.77.75:995 207.246.77.75:443 207.246.77.75:2222 149.28.101.90:995 45.77.117.108:995 45.77.117.108:8443 45.77.115.208:995 71.163.222.223:443 90.87.245.154:2222 207.246.116.237:995 207.246.116.237:443 45.63.107.192:2222 207.246.116.237:8443 207.246.116.237:2222 24.179.77.236:443 184.185.103.157:443 217.165.164.110:2222 213.122.113.120:443 193.248.221.184:2222 188.27.179.172:443 222.153.169.147:995 100.2.20.137:443 172.78.42.79:443 97.69.160.4:2222 105.198.236.101:443 98.192.185.86:443 186.144.33.73:443 96.61.23.88:995 86.220.60.247:2222 71.41.184.10:3389 175.143.92.16:443 46.149.81.250:443 98.252.118.134:443 92.96.3.180:2078 71.187.170.235:443 50.244.112.106:443 24.122.118.18:443 47.196.213.73:443 186.154.175.13:443 70.163.161.79:443 78.63.226.32:443 76.168.147.166:993 77.27.207.217:995 31.4.242.28:995 125.62.192.195:443 195.12.154.8:443 96.21.251.127:2222 71.199.192.62:443 70.168.130.172:995 82.12.157.95:995 209.210.187.52:995 209.210.187.52:443 67.6.12.4:443 189.222.59.177:443 174.104.22.30:443 142.117.191.18:2222 189.146.183.105:443 213.60.147.140:443 196.221.207.137:995 108.46.145.30:443 187.250.238.164:995 2.7.116.188:2222 195.43.173.70:443 106.250.150.98:443 45.67.231.247:443 83.110.103.152:443 83.110.9.71:2222 78.97.207.104:443 59.90.246.200:443 80.227.5.69:443 125.63.101.62:443 86.236.77.68:2222 109.106.69.138:2222 84.72.35.226:443 217.133.54.140:32100 197.161.154.132:443 89.137.211.239:995 74.222.204.82:995 122.148.156.131:995 156.223.110.23:443 144.139.166.18:443 202.185.166.181:443 76.94.200.148:995 71.63.120.101:443 196.151.252.84:443 202.188.138.162:443

Target

44459.8061394676.dat

MD5

a372400cbff205def639e4db62ef17b4

Filesize

823KB

Score

10 ^/10

SHA1

445447a8cd34df42d7fd786a164389cf8e5f82db

SHA256

63deda6fe8af221a650f6ba6a2ee6c7fec17f10bc5e063c9b0aaee4981a01150

SHA512

763807749271cf66fa935b4da272ede62543971e124680381af5f22dd20d48d7f297dfcfb441ad3e56b96902129428d925b89e37ebc745b62d641fe7802b5457

Signatures

Qakbot/Qbot

Description

Qbot or Qakbot is a sophisticated worm with banking capabilities.

Tags

trojan banker stealer qakbot
Loads dropped DLL

Related Tasks

behavioral1 behavioral2

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Scheduled Task

Privilege Escalation

static1

behavioral1

qakbot obama100 1632151873 banker stealer trojan

10^/10

behavioral2

qakbot obama100 1632151873 banker stealer trojan

10^/10

Extracted

Tags

Signatures

Qakbot/Qbot

Description

Tags

Loads dropped DLL

Related Tasks

static1

behavioral1

behavioral2