qakbot | b420642be3fb8799c1700185d9a68a7de077fd798ef9ad024f728b5a031fd94c

General

Target

CompensationClaim-68254946-09282021.zip
Size

90KB
Sample

210928-s1h9zscdbp
MD5

751ba3695041a3dfb2d283da3ede15fb
SHA1

002c1f3a1606c6fd24eccf69956d27287ff4f74a
SHA256

b420642be3fb8799c1700185d9a68a7de077fd798ef9ad024f728b5a031fd94c
SHA512

83b5c3ed629f4a0ef47c25878f58ef9b9c86f3c1d3d366c177948fea8254649d1175f4638e1701ddd60186ba3185ba6dcd4a1f7ec2c5d816ba789f58421b3e1a

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://101.99.90.160/44467.7331923611.dat

xlm40.dropper

http://188.165.62.4/44467.7331923611.dat

xlm40.dropper

http://84.32.188.42/44467.7331923611.dat

xlm40.dropper

http://101.99.90.160/44467.7348045139.dat

xlm40.dropper

http://188.165.62.4/44467.7348045139.dat

xlm40.dropper

http://84.32.188.42/44467.7348045139.dat

Extracted

Family

qakbot

Version

402.363

Botnet

obama105

Campaign

1632821932

C2

120.151.47.189:443

41.228.22.180:443

39.52.241.3:995

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://101.99.90.160/44467.6499013889.dat

xlm40.dropper

http://188.165.62.4/44467.6499013889.dat

xlm40.dropper

http://84.32.188.42/44467.6499013889.dat

Extracted

Family

qakbot

Version

402.363

Botnet

notset

Campaign

1632819510

C2

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

Targets

- Target
  
  CompensationClaim-68254946-09282021.xls
- Size
  
  137KB
- MD5
  
  e0574cf808d9b7150bac6b894baec9f0
- SHA1
  
  6603fa83dbb84f3a0d35982a37dbc5250699a64a
- SHA256
  
  7fddbdbd20255e29207d6765f7c3d19a235be7e55ca6184a76a74c2175da8bf4
- SHA512
  
  9f98689c83358a470dd50f9f74fc80147e025acb2b88b3a4c8d100a07b3c159097e56950eeee7a71c490ff2dea85a7fb92b4f354c7d8f3bedb1fb13854f07bb8
Score

10^/10

qakbot obama105 1632821932 banker evasion stealer trojan notset 1632819510
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2