qakbot | 058299a1b3a0634c0a6486a7ae043ca0c0ff24148843d6b322354c86e82a0608

General

Target

058299a1b3a0634c0a6486a7ae043ca0c0ff24148843d6b322354c86e82a0608
Size

400KB
Sample

220213-2jae7adfak
MD5

30f804952e82a4bf30c776402967850f
SHA1

6db90c30220e594b31366a24a53fdb55308a4357
SHA256

058299a1b3a0634c0a6486a7ae043ca0c0ff24148843d6b322354c86e82a0608
SHA512

987063f865d77919d8ec3bacdba9380a67a7c39c528a332dcd038cd5577a091928e569fdf4e00bdb876cb234ecaa2dd8bafb5aa97b4331b8564c1f69e90b6c92

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

322.148

Campaign

1518695014

Credentials

Protocol: ftp
Host:
66.96.133.9
Port:
21
Username:
help
Password:
eT5TerAcnFe6~

Protocol: ftp
Host:
174.123.38.58
Port:
21
Username:
[email protected]
Password:
4BQ1MeeRAwNZEVu

Protocol: ftp
Host:
61.221.12.26
Port:
21
Username:
[email protected]
Password:
346HZGCMlwecz9S

Protocol: ftp
Host:
67.222.137.18
Port:
21
Username:
[email protected]
Password:
p4a8k6fE1FtA3pR

Protocol: ftp
Host:
107.6.152.61
Port:
21
Username:
[email protected]
Password:
RoP4Af0RKAAQ74V

C2

179.62.153.88:443

50.198.141.161:2222

69.129.91.38:443

66.189.228.49:995

96.253.104.73:443

71.183.129.113:443

125.25.130.203:995

173.175.174.154:443

162.104.186.175:995

75.109.222.140:995

68.173.55.51:443

78.175.254.43:443

106.159.251.143:995

47.143.83.172:443

71.190.202.120:443

73.136.232.174:995

96.253.104.73:995

192.158.217.32:22

65.153.16.250:993

70.95.129.59:443

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://www.allens-treasure-house.com/books_files/001.ps1

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://www.allens-treasure-house.com/books_files/001.ps1

Targets

- Target
  
  058299a1b3a0634c0a6486a7ae043ca0c0ff24148843d6b322354c86e82a0608
- Size
  
  400KB
- MD5
  
  30f804952e82a4bf30c776402967850f
- SHA1
  
  6db90c30220e594b31366a24a53fdb55308a4357
- SHA256
  
  058299a1b3a0634c0a6486a7ae043ca0c0ff24148843d6b322354c86e82a0608
- SHA512
  
  987063f865d77919d8ec3bacdba9380a67a7c39c528a332dcd038cd5577a091928e569fdf4e00bdb876cb234ecaa2dd8bafb5aa97b4331b8564c1f69e90b6c92
Score

10^/10

qakbot 1518695014 banker persistence stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Blocklisted process makes network request
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2