General

  • Target
    heralook.bin
  • Size 414KB
  • Sample220708-lcf2dsdca8
  • SHA256 2d68755335776e3de28fcd1757b7dcc07688b31c37205ce2324d92c2f419c6f0
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • qakbot

Version
  • 403.780

Botnet
  • obama194

Campaign
  • 1656313665

C2
  • 70.46.220.114:443

  • 32.221.224.140:995

  • 67.209.195.198:443

  • 186.90.153.162:2222

  • 148.64.96.100:443

  • 67.165.206.193:993

  • 86.200.151.188:2222

  • 80.11.74.81:2222

  • 173.174.216.62:443

  • 45.241.173.232:993

  • 41.228.22.180:443

  • 1.161.81.21:995

  • 24.178.196.158:2222

  • 37.34.253.233:443

  • 93.48.80.198:995

  • 129.208.158.180:995

  • 120.150.218.241:995

  • 38.70.253.226:2222

  • 111.125.245.116:995

  • 47.23.89.60:993

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target
      heralook.bin
    • Size 414KB
    • SHA256 2d68755335776e3de28fcd1757b7dcc07688b31c37205ce2324d92c2f419c6f0
    • MD5 SHA1 SHA512
    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks