1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin

General
Target

1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin

Size

890KB

Sample

211021-sf5x9aadh8

Score
10 /10
MD5

94128f783ebffa5f5203389d3dc26a0e

SHA1

577840a380a9b4f7aeddd00fa21b15a4926755be

SHA256

1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe

SHA512

94afeb12874513354fbf0d23cd7589b962e88efc45a669f01f3f04bde31562b304cd80cdf5d47e75925d4d37292bbe563c0d2f2999e8758520d1858dc4e1765b

Malware Config

Extracted

Family qakbot
Version 402.363
Botnet biden54
Campaign 1634810637
C2

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

81.250.153.227:2222

120.150.218.241:995

76.25.142.196:443

89.101.97.139:443

81.213.59.22:443

173.21.10.71:2222

103.142.10.177:443

71.74.12.34:443

24.231.209.2:2222

75.188.35.168:443

209.210.95.228:995

73.151.236.31:443

220.255.25.187:2222

187.156.134.254:443

189.175.219.53:80

108.4.67.252:443

209.210.95.228:993

67.165.206.193:993

173.25.162.221:443

100.1.119.41:443

93.48.58.123:2222

65.100.174.110:443

201.137.10.225:443

24.229.150.54:995

146.66.238.74:443

68.204.7.158:443

37.208.181.198:443

41.86.42.158:995

189.135.16.92:443

187.75.66.160:995

Attributes
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Targets
Target

1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin

MD5

94128f783ebffa5f5203389d3dc26a0e

Filesize

890KB

Score
10 /10
SHA1

577840a380a9b4f7aeddd00fa21b15a4926755be

SHA256

1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe

SHA512

94afeb12874513354fbf0d23cd7589b962e88efc45a669f01f3f04bde31562b304cd80cdf5d47e75925d4d37292bbe563c0d2f2999e8758520d1858dc4e1765b

Tags

Signatures

  • Qakbot/Qbot

    Description

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    Tags

  • Windows security bypass

    Tags

    TTPs

    Disabling Security Tools Modify Registry
  • Loads dropped DLL

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation