General

  • Target

    736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9

  • Size

    2.6MB

  • Sample

    220521-mvq5raffdk

  • MD5

    7d05b151fd2b28582cfca8ca8ceaa58f

  • SHA1

    6d4d8baf550550ebd1e15f3b3a697f8516fe79cf

  • SHA256

    736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9

  • SHA512

    5e6b7105b5e36581a43b9d6e6e460c6ea08618a3b8fbad52f2aafdee4f4162dc40e6a723b03488dcf7f200ee251f3588c41cc41149739dfccc65988b29b77fb2

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx135

Campaign

1591627649

C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

Targets

    • Target

      736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9

    • Size

      2.6MB

    • MD5

      7d05b151fd2b28582cfca8ca8ceaa58f

    • SHA1

      6d4d8baf550550ebd1e15f3b3a697f8516fe79cf

    • SHA256

      736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9

    • SHA512

      5e6b7105b5e36581a43b9d6e6e460c6ea08618a3b8fbad52f2aafdee4f4162dc40e6a723b03488dcf7f200ee251f3588c41cc41149739dfccc65988b29b77fb2

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks