qakbot | 9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36

Sharing

Copy URL Twitter E-mail

General

Target
9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36
Size 670KB
Sample220709-h1hckscfgl
SHA256 9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36
MD5 a177c3d97014f37d9f5c9514a796180a
SHA1 7e437cc4a8074910895969347667bc1fd53df1d6
SHA512 3fe35944c2c983c9279f75b6772e6eec80eb49ab5b8d5fdd41e7abfdb2f4e26f0b396ad5693c5836e3a38975db64cb08b2892a2811455276586b85ba0ebf84c0
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama199

Campaign

1657265474

121.7.223.45:2222
67.209.195.198:443
148.64.96.100:443
92.132.132.81:2222
217.128.122.65:2222
47.180.172.159:443
173.174.216.62:443
70.46.220.114:443
32.221.224.140:995
69.14.172.24:443
117.248.109.38:21
94.59.15.180:2222
38.70.253.226:2222
217.165.157.202:995
41.228.22.180:443
67.165.206.193:993
172.115.177.204:2222
186.90.153.162:2222
47.23.89.60:993
120.150.218.241:995
93.48.80.198:995
89.211.209.234:2222
197.89.12.70:443
208.107.221.224:443
24.178.196.158:2222
66.230.104.103:443
118.161.14.242:995
24.158.23.166:995
100.38.242.113:995
37.208.132.76:50010
63.143.92.99:995
182.191.92.203:995
86.97.246.166:1194
74.14.5.179:2222
40.134.246.185:995
111.125.245.116:995
173.21.10.71:2222
76.25.142.196:443
142.186.49.224:2222
118.161.14.242:443
174.69.215.101:443
187.172.164.12:443
129.208.151.177:995
70.51.137.244:2222
190.252.242.69:443
24.55.67.176:443
103.246.242.202:443
89.101.97.139:443
47.156.129.52:443
72.252.157.93:993
72.252.157.93:990
72.252.157.93:995
177.94.65.26:32101
24.139.72.117:443
82.41.63.217:443
179.158.105.44:443
81.132.186.218:2078
201.172.20.167:2222
37.186.58.99:995
37.34.253.233:443
125.25.133.223:443
45.241.254.69:993
39.49.41.221:995
196.203.37.215:80
88.240.59.52:443
39.44.60.200:995
86.97.10.37:443
86.98.157.114:993
109.12.111.14:443
81.193.30.90:443
39.52.59.221:995
39.41.16.210:995
106.51.48.188:50001
86.97.209.138:2222
104.34.212.7:32103
86.213.75.30:2078
45.46.53.140:2222
39.57.56.11:995
84.241.8.23:32103
2.178.166.220:61202
24.43.99.75:443
101.50.67.155:995
41.13.224.28:443
108.56.213.219:995
189.253.167.141:443
5.32.41.45:443
120.61.1.141:443
177.189.180.214:32101
94.36.193.176:2222
39.53.124.57:995
80.11.74.81:2222
41.84.224.109:443
103.116.178.85:995
209.15.76.228:443
184.97.29.26:443
102.65.66.66:443
39.52.221.9:995
191.112.26.57:443
210.246.4.69:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36
- Size 670KB
- SHA256 9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36
- MD5 a177c3d97014f37d9f5c9514a796180a
- SHA1 7e437cc4a8074910895969347667bc1fd53df1d6
- SHA512 3fe35944c2c983c9279f75b6772e6eec80eb49ab5b8d5fdd41e7abfdb2f4e26f0b396ad5693c5836e3a38975db64cb08b2892a2811455276586b85ba0ebf84c0
- MD5 SHA1 SHA512
Score

10^/10

qakbot obama199 1657265474 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2