qakbot | 6347cd969b7f0837f608068b4f32c6513a1459ef60cd80a066d70225b40c1a80

General

Target

6347cd969b7f0837f608068b4f32c6513a1459ef60cd80a066d70225b40c1a80
Size

397KB
Sample

220214-s9naasbceq
MD5

a0a9bf99af2c13b678a17f3f7f8b73c8
SHA1

802b22bdd827d1921534d93d31e9df2735156210
SHA256

6347cd969b7f0837f608068b4f32c6513a1459ef60cd80a066d70225b40c1a80
SHA512

3d7f7ab8f09a65ea0c0908fb747ce07228b0d750b66b4412a5ef7a4a12f6edad013dccceaa1d412392ba8c42e51226ce17392c43923bc3626d88a1eb9d7ba415

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

322.148

Campaign

1518695014

Credentials

Protocol: ftp
Host:
66.96.133.9
Port:
21
Username:
help
Password:
eT5TerAcnFe6~

Protocol: ftp
Host:
174.123.38.58
Port:
21
Username:
[email protected]
Password:
4BQ1MeeRAwNZEVu

Protocol: ftp
Host:
61.221.12.26
Port:
21
Username:
[email protected]
Password:
346HZGCMlwecz9S

Protocol: ftp
Host:
67.222.137.18
Port:
21
Username:
[email protected]
Password:
p4a8k6fE1FtA3pR

Protocol: ftp
Host:
107.6.152.61
Port:
21
Username:
[email protected]
Password:
RoP4Af0RKAAQ74V

C2

179.62.153.88:443

50.198.141.161:2222

69.129.91.38:443

66.189.228.49:995

96.253.104.73:443

71.183.129.113:443

125.25.130.203:995

173.175.174.154:443

162.104.186.175:995

75.109.222.140:995

68.173.55.51:443

78.175.254.43:443

106.159.251.143:995

47.143.83.172:443

71.190.202.120:443

73.136.232.174:995

96.253.104.73:995

192.158.217.32:22

65.153.16.250:993

70.95.129.59:443

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://www.allens-treasure-house.com/books_files/001.ps1

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://www.allens-treasure-house.com/books_files/001.ps1

Targets

- Target
  
  6347cd969b7f0837f608068b4f32c6513a1459ef60cd80a066d70225b40c1a80
- Size
  
  397KB
- MD5
  
  a0a9bf99af2c13b678a17f3f7f8b73c8
- SHA1
  
  802b22bdd827d1921534d93d31e9df2735156210
- SHA256
  
  6347cd969b7f0837f608068b4f32c6513a1459ef60cd80a066d70225b40c1a80
- SHA512
  
  3d7f7ab8f09a65ea0c0908fb747ce07228b0d750b66b4412a5ef7a4a12f6edad013dccceaa1d412392ba8c42e51226ce17392c43923bc3626d88a1eb9d7ba415
Score

10^/10

qakbot 1518695014 banker persistence stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Blocklisted process makes network request
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2