qakbot | c0a3994bb5140514f73ecfb49ba1f8a74c2cf3c31dde10c79fa5b8f615ce16b4

General

Target

Compensation-1027110219.xls
Size

233KB
Sample

210930-pa7ywahffn
MD5

76c5b3c16a42fd876d3c8648063ebefd
SHA1

17eb233138408ec24ee1d300c7fdec089d534766
SHA256

c0a3994bb5140514f73ecfb49ba1f8a74c2cf3c31dde10c79fa5b8f615ce16b4
SHA512

e50ac5cff53c6d014b73db0a1de64fd3904fb9b55b65c0278d284fda0b9fa4d6b0a5038f6cfc3618b13103d64dbbcb81ca40b5a27621a00090f6d53a03f0eedc

Score

10^/10

qakbot tr 1632817399 banker macro stealer trojan xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://safalerp.com/J1wlINw7HtJ/siera.xml

xlm40.dropper

https://godschildrenaf.org/qxwbRMzrqoWK/siera.xml

xlm40.dropper

https://callgirlsandescortkenya.site/hllzvTuU/siera.xml

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Targets

- Target
  
  Compensation-1027110219.xls
- Size
  
  233KB
- MD5
  
  76c5b3c16a42fd876d3c8648063ebefd
- SHA1
  
  17eb233138408ec24ee1d300c7fdec089d534766
- SHA256
  
  c0a3994bb5140514f73ecfb49ba1f8a74c2cf3c31dde10c79fa5b8f615ce16b4
- SHA512
  
  e50ac5cff53c6d014b73db0a1de64fd3904fb9b55b65c0278d284fda0b9fa4d6b0a5038f6cfc3618b13103d64dbbcb81ca40b5a27621a00090f6d53a03f0eedc
Score

10^/10

qakbot tr 1632817399 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2