qakbot | 62d8610935ea360961511fa6361d82248dfdaae459bb6fab4bbc2f924627172c

General

Target

Compensation-1093400938.xls
Size

233KB
Sample

210930-qdayzshgd4
MD5

9952a72e006111e4a9613c5bdbd7982f
SHA1

a642c5d809d3b2cad15f1ca0fb56a8bce54ca086
SHA256

62d8610935ea360961511fa6361d82248dfdaae459bb6fab4bbc2f924627172c
SHA512

febd4bc0154ad140e9dcb9f5ba0464b9253b5e9df8a2c652252dba63f226d09c68f4b19d587476805591c1cb7f7041dc56d78908e03154a81ec2039b8016d6c2

Score

10^/10

qakbot tr 1632817399 banker macro stealer trojan xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://safalerp.com/J1wlINw7HtJ/siera.xml

xlm40.dropper

https://godschildrenaf.org/qxwbRMzrqoWK/siera.xml

xlm40.dropper

https://callgirlsandescortkenya.site/hllzvTuU/siera.xml

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Targets

- Target
  
  Compensation-1093400938.xls
- Size
  
  233KB
- MD5
  
  9952a72e006111e4a9613c5bdbd7982f
- SHA1
  
  a642c5d809d3b2cad15f1ca0fb56a8bce54ca086
- SHA256
  
  62d8610935ea360961511fa6361d82248dfdaae459bb6fab4bbc2f924627172c
- SHA512
  
  febd4bc0154ad140e9dcb9f5ba0464b9253b5e9df8a2c652252dba63f226d09c68f4b19d587476805591c1cb7f7041dc56d78908e03154a81ec2039b8016d6c2
Score

10^/10

qakbot tr 1632817399 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2