qakbot | 73e9c07b6422fb135f06e0660b24a08be7d5bfe5b77d2b9f0096f8d03af52876

General

Target

73e9c07b6422fb135f06e0660b24a08be7d5bfe5b77d2b9f0096f8d03af52876.dll
Size

598KB
Sample

220908-qykc6aefg3
MD5

21fde02f02280fdad7cd446c8bf600c7
SHA1

7da9c4a62c742ff5a854ef4fbbaa11e3447e0c97
SHA256

73e9c07b6422fb135f06e0660b24a08be7d5bfe5b77d2b9f0096f8d03af52876
SHA512

3069734ac96e504bc22502b02a537456740dc99aecb1d78ed1a6adbd30780632dd37af811ab9dc64a71a19889f210a5718a5357dda326fbc53f5828b739eb1f2
SSDEEP

12288:czF6eBVYHBQ3DvlYuZ+wNTYyujPt5ABJXT+gb:Oo1HBuKuja1D4XTv

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.858

Botnet

snow01

Campaign

1662453469

C2

200.161.62.126:32101

217.165.68.122:993

99.232.140.205:2222

81.131.161.131:2078

89.211.179.14:2222

186.64.87.202:443

197.94.210.133:443

193.3.19.37:443

37.210.148.30:995

200.100.55.252:32101

70.51.153.182:2222

120.150.218.241:995

173.189.167.21:995

24.139.72.117:443

104.34.212.7:32103

47.23.89.61:995

24.55.67.176:443

172.115.177.204:2222

217.165.77.134:995

24.178.196.158:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  
  73e9c07b6422fb135f06e0660b24a08be7d5bfe5b77d2b9f0096f8d03af52876.dll
- Size
  
  598KB
- MD5
  
  21fde02f02280fdad7cd446c8bf600c7
- SHA1
  
  7da9c4a62c742ff5a854ef4fbbaa11e3447e0c97
- SHA256
  
  73e9c07b6422fb135f06e0660b24a08be7d5bfe5b77d2b9f0096f8d03af52876
- SHA512
  
  3069734ac96e504bc22502b02a537456740dc99aecb1d78ed1a6adbd30780632dd37af811ab9dc64a71a19889f210a5718a5357dda326fbc53f5828b739eb1f2
- SSDEEP
  
  12288:czF6eBVYHBQ3DvlYuZ+wNTYyujPt5ABJXT+gb:Oo1HBuKuja1D4XTv
Score

10^/10

qakbot snow01 1662453469 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2