qakbot | 5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d

Sharing

Copy URL Twitter E-mail

General

Target
5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d
Size 686KB
Sample220712-hvcvxafcfp
SHA256 5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d
MD5 2e55346926ea3aa912e14a4f92364a64
SHA1 30d30e4fffa867ead9318dd6c0358133ff49258e
SHA512 5d95297012c7248e61b3d48df065b28643456e1ad0cec040945e575234fcc8ebbcbe08c4052a0831191155058a71ef4582037fb54914ece382f13240de02f38f
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama200

Campaign

1657548298

172.115.177.204:2222
89.101.97.139:443
186.90.153.162:2222
38.70.253.226:2222
120.150.218.241:995
72.252.157.93:995
72.252.157.93:993
94.36.193.176:2222
47.23.89.60:993
89.211.209.234:2222
76.25.142.196:443
46.100.25.239:61202
24.158.23.166:995
69.14.172.24:443
92.132.132.81:2222
37.34.253.233:443
93.48.80.198:995
174.80.15.101:2083
24.178.196.158:2222
197.89.20.137:443
66.230.104.103:443
177.94.65.26:32101
208.107.221.224:443
100.38.242.113:995
24.55.67.176:443
40.134.246.185:995
24.139.72.117:443
74.14.5.179:2222
67.209.195.198:443
148.64.96.100:443
217.128.122.65:2222
196.203.37.215:80
47.180.172.159:443
32.221.224.140:995
117.248.109.38:21
70.46.220.114:443
176.45.218.138:995
94.59.15.180:2222
84.241.8.23:32103
81.158.239.251:2078
179.158.105.44:443
104.34.212.7:32103
41.228.22.180:443
217.165.157.202:995
109.12.111.14:443
67.165.206.193:993
111.125.245.116:995
1.161.79.116:443
1.161.79.116:995
81.193.30.90:443
103.133.11.10:995
174.69.215.101:443
173.21.10.71:2222
197.94.75.223:443
45.46.53.140:2222
96.37.113.36:993
120.61.3.142:443
182.52.159.24:443
190.252.242.69:443
187.172.164.12:443
201.172.23.72:2222
70.51.137.244:2222
37.208.131.49:50010
173.174.216.62:443
103.246.242.202:443
72.252.157.93:990
63.143.92.99:995
106.51.48.188:50001
182.191.92.203:995
86.97.246.166:1194
121.7.223.45:2222
67.69.166.79:2222
47.156.129.52:443
82.41.63.217:443
37.186.58.99:995
45.241.254.69:993
39.49.41.221:995
88.240.59.52:443
39.44.60.200:995
86.97.10.37:443
86.98.157.114:993
39.52.59.221:995
39.41.16.210:995
86.97.246.166:2222
86.213.75.30:2078
39.57.56.11:995
24.43.99.75:443
101.50.67.155:995
108.56.213.219:995
189.253.167.141:443
5.32.41.45:443
177.189.180.214:32101
39.53.124.57:995
80.11.74.81:2222
41.84.224.109:443
103.116.178.85:995
209.15.76.228:443
184.97.29.26:443
102.65.60.92:443
39.52.221.9:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d
- Size 686KB
- SHA256 5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d
- MD5 2e55346926ea3aa912e14a4f92364a64
- SHA1 30d30e4fffa867ead9318dd6c0358133ff49258e
- SHA512 5d95297012c7248e61b3d48df065b28643456e1ad0cec040945e575234fcc8ebbcbe08c4052a0831191155058a71ef4582037fb54914ece382f13240de02f38f
- MD5 SHA1 SHA512
Score

10^/10

qakbot obama200 1657548298 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2