qakbot | 790951787b259b98ea0f3b7face9c805643bd5e36b2d8a9d92d6d20a7107971b

Sharing

Copy URL Twitter E-mail

General

Target
dxv1.ocx
Size 1.1MB
Sample220215-r9be3ahdcm
SHA256 790951787b259b98ea0f3b7face9c805643bd5e36b2d8a9d92d6d20a7107971b
MD5 5508b01862cd1f328f92f66656025b5f
SHA1 025e1efde052d4682db9af50eb09f6b8170028fa
SHA512 20c608457d693e160d31bc19f96dd5a6222254270d1718ec74348ba0323a9713a2caf8b93806e6e8f25f9dfc7cc3338e89ac463241456a4f6ef7d3acc0f9389a
MD5 SHA1 SHA512

Score

10^/10

qakbot tr 1644836475 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.503

Botnet

Campaign

1644836475

220.255.25.1:2222
180.233.150.134:995
129.208.11.149:995
102.65.38.67:443
78.96.235.245:443
24.53.49.240:443
78.87.41.5:995
136.143.11.232:443
140.82.49.12:443
111.125.245.116:995
82.41.63.217:443
24.178.196.158:2222
38.70.253.226:2222
74.15.2.252:2222
92.177.45.46:2078
209.210.95.228:32100
37.211.176.26:61202
149.135.101.20:443
24.222.20.254:443
96.21.251.127:2222
80.14.196.176:2222
176.67.56.94:443
120.150.218.241:995
1.161.70.155:995
32.221.231.1:443
75.67.73.144:443
82.152.39.39:443
1.161.70.155:443
41.230.62.211:993
31.215.116.182:2222
139.64.13.189:443
76.25.142.196:443
75.156.151.34:443
42.235.144.180:2222
2.50.41.69:61200
31.215.99.178:443
39.44.150.120:995
67.209.195.198:443
37.210.157.12:2222
103.142.10.177:443
39.49.98.233:995
89.101.97.139:443
45.9.20.200:443
128.106.122.39:443
86.98.156.45:993
86.98.156.82:32101
212.34.15.205:443
103.17.101.139:995
217.164.115.166:2222
96.246.158.154:995
217.128.171.34:2222
41.143.153.235:443
190.73.3.148:2222
41.228.22.180:443
86.98.49.16:443
182.191.92.203:995
89.137.52.44:443
86.98.148.144:995
75.188.35.168:443
31.215.185.99:1194
173.21.10.71:2222
71.74.12.34:443
45.46.53.140:2222
73.151.236.31:443
67.165.206.193:993
96.37.113.36:993
95.14.105.51:995
76.23.237.163:995
184.100.174.73:443
109.12.111.14:443
217.165.139.33:995
161.142.62.76:443
68.204.7.158:443
87.71.79.81:443
218.101.110.3:995
31.35.28.29:443
94.60.254.81:443
114.79.148.170:443
70.51.137.204:2222
31.215.206.13:443
24.152.219.253:995
101.50.120.112:995
69.14.172.24:443
117.248.109.38:21
78.101.202.183:443
37.177.81.142:995
64.231.96.211:2222
103.139.242.30:990
72.252.201.34:990
201.172.31.135:80
100.1.108.246:443
72.252.201.34:995
190.206.211.182:443
40.134.247.125:995
108.4.67.252:443
70.45.27.254:443
197.89.20.13:443
113.28.253.9:995
41.86.42.158:995
5.32.41.46:443
78.164.40.62:995
105.184.195.32:995
217.128.93.27:2222
80.6.192.58:443
136.232.34.70:443
182.176.180.73:443
39.52.213.0:995
103.139.242.30:993
75.169.34.158:443
31.215.29.238:443
89.86.33.217:443
173.26.188.246:443
41.84.238.71:443
23.82.128.108:443
24.95.61.62:443
144.86.6.161:443
113.211.127.95:443
86.198.170.170:2222
70.163.1.219:443
31.215.23.29:2222
37.203.225.248:443
193.251.59.245:2222
73.59.201.174:443
73.136.32.202:443
86.178.220.77:443
31.215.142.105:2078
73.67.152.98:2222
43.231.252.200:443
41.209.126.246:443
37.186.54.25:995
181.118.183.28:443
162.210.220.137:2222
188.50.206.1:995
103.123.225.38:6881
70.50.147.95:2222
72.66.116.235:995
187.191.33.158:443
165.255.54.11:995
31.166.23.80:443
65.100.174.110:8443
65.100.174.110:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  dxv1.ocx
- Size 1.1MB
- SHA256 790951787b259b98ea0f3b7face9c805643bd5e36b2d8a9d92d6d20a7107971b
- MD5 5508b01862cd1f328f92f66656025b5f
- SHA1 025e1efde052d4682db9af50eb09f6b8170028fa
- SHA512 20c608457d693e160d31bc19f96dd5a6222254270d1718ec74348ba0323a9713a2caf8b93806e6e8f25f9dfc7cc3338e89ac463241456a4f6ef7d3acc0f9389a
- MD5 SHA1 SHA512
Score

10^/10

qakbot tr 1644836475 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2