736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9

General
Target

736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9

Size

2MB

Sample

220521-mvq5raffdk

Score
10 /10
MD5

7d05b151fd2b28582cfca8ca8ceaa58f

SHA1

6d4d8baf550550ebd1e15f3b3a697f8516fe79cf

SHA256

736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9

SHA512

5e6b7105b5e36581a43b9d6e6e460c6ea08618a3b8fbad52f2aafdee4f4162dc40e6a723b03488dcf7f200ee251f3588c41cc41149739dfccc65988b29b77fb2

Malware Config

Extracted

Family qakbot
Version 324.142
Botnet spx135
Campaign 1591627649
C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

102.41.122.185:995

67.131.59.17:443

184.98.104.7:995

69.11.247.242:443

201.127.4.70:443

72.204.242.138:50003

189.231.198.212:443

5.14.44.173:2222

5.14.76.156:443

151.205.102.42:443

179.51.23.31:443

72.190.101.70:443

73.76.47.127:443

80.240.26.178:443

72.36.59.46:2222

73.209.113.58:443

68.49.120.179:443

69.92.54.95:995

187.19.151.218:995

50.244.112.10:443

66.222.88.126:995

207.255.161.8:32102

108.58.9.238:995

105.98.154.57:443

98.219.77.197:443

216.163.4.91:443

47.152.210.233:443

178.223.17.74:995

72.204.242.138:20

82.127.193.151:2222

Targets
Target

736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9

MD5

7d05b151fd2b28582cfca8ca8ceaa58f

Filesize

2MB

Score
10/10
SHA1

6d4d8baf550550ebd1e15f3b3a697f8516fe79cf

SHA256

736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9

SHA512

5e6b7105b5e36581a43b9d6e6e460c6ea08618a3b8fbad52f2aafdee4f4162dc40e6a723b03488dcf7f200ee251f3588c41cc41149739dfccc65988b29b77fb2

Tags

Signatures

  • Qakbot/Qbot

    Description

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    Tags

  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation