qakbot | d554cf5e1dd65dc5d013e04bce060bbe8029302c0da6d02fad3f58010c5a554b

Sharing

Copy URL Twitter E-mail

General

Target
d554cf5e1dd65dc5d013e04bce060bbe8029302c0da6d02fad3f58010c5a554b
Size 670KB
Sample220709-h1hckscfgn
SHA256 d554cf5e1dd65dc5d013e04bce060bbe8029302c0da6d02fad3f58010c5a554b
MD5 044033044c3dcbe70b37dfa51656c99d
SHA1 8b076bb8305a215b2b31d2c280e818dc93bd2768
SHA512 6422bd83cde08fc626898bc2d62012044c975242985230a8d2fc23ac19886fe646bc0193076047c514e6c194e5f5793d5ac14be7541cc2fde1354eaf0988c545
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama199

Campaign

1657265474

121.7.223.45:2222
67.209.195.198:443
148.64.96.100:443
92.132.132.81:2222
217.128.122.65:2222
47.180.172.159:443
173.174.216.62:443
70.46.220.114:443
32.221.224.140:995
69.14.172.24:443
117.248.109.38:21
94.59.15.180:2222
38.70.253.226:2222
217.165.157.202:995
41.228.22.180:443
67.165.206.193:993
172.115.177.204:2222
186.90.153.162:2222
47.23.89.60:993
120.150.218.241:995
93.48.80.198:995
89.211.209.234:2222
197.89.12.70:443
208.107.221.224:443
24.178.196.158:2222
66.230.104.103:443
118.161.14.242:995
24.158.23.166:995
100.38.242.113:995
37.208.132.76:50010
63.143.92.99:995
182.191.92.203:995
86.97.246.166:1194
74.14.5.179:2222
40.134.246.185:995
111.125.245.116:995
173.21.10.71:2222
76.25.142.196:443
142.186.49.224:2222
118.161.14.242:443
174.69.215.101:443
187.172.164.12:443
129.208.151.177:995
70.51.137.244:2222
190.252.242.69:443
24.55.67.176:443
103.246.242.202:443
89.101.97.139:443
47.156.129.52:443
72.252.157.93:993
72.252.157.93:990
72.252.157.93:995
177.94.65.26:32101
24.139.72.117:443
82.41.63.217:443
179.158.105.44:443
81.132.186.218:2078
201.172.20.167:2222
37.186.58.99:995
37.34.253.233:443
125.25.133.223:443
45.241.254.69:993
39.49.41.221:995
196.203.37.215:80
88.240.59.52:443
39.44.60.200:995
86.97.10.37:443
86.98.157.114:993
109.12.111.14:443
81.193.30.90:443
39.52.59.221:995
39.41.16.210:995
106.51.48.188:50001
86.97.209.138:2222
104.34.212.7:32103
86.213.75.30:2078
45.46.53.140:2222
39.57.56.11:995
84.241.8.23:32103
2.178.166.220:61202
24.43.99.75:443
101.50.67.155:995
41.13.224.28:443
108.56.213.219:995
189.253.167.141:443
5.32.41.45:443
120.61.1.141:443
177.189.180.214:32101
94.36.193.176:2222
39.53.124.57:995
80.11.74.81:2222
41.84.224.109:443
103.116.178.85:995
209.15.76.228:443
184.97.29.26:443
102.65.66.66:443
39.52.221.9:995
191.112.26.57:443
210.246.4.69:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  d554cf5e1dd65dc5d013e04bce060bbe8029302c0da6d02fad3f58010c5a554b
- Size 670KB
- SHA256 d554cf5e1dd65dc5d013e04bce060bbe8029302c0da6d02fad3f58010c5a554b
- MD5 044033044c3dcbe70b37dfa51656c99d
- SHA1 8b076bb8305a215b2b31d2c280e818dc93bd2768
- SHA512 6422bd83cde08fc626898bc2d62012044c975242985230a8d2fc23ac19886fe646bc0193076047c514e6c194e5f5793d5ac14be7541cc2fde1354eaf0988c545
- MD5 SHA1 SHA512
Score

10^/10

qakbot obama199 1657265474 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2