qakbot | 489cc0ce8393870d0c7b01891d56e267cecc2edce79e774af996cdcf4fbda411

Sharing

Copy URL Twitter E-mail

General

Target
Original4030.iso
Size 634KB
Sample221018-vsmzbaggfk
SHA256 489cc0ce8393870d0c7b01891d56e267cecc2edce79e774af996cdcf4fbda411
MD5 0605c80ce3da18c57a339730981349a6
SHA1 81d81119a0ccaa1011c9f14f87e4759a0c3cd2c7
SHA512 5875ae8c97cfe5cdfdf365d16fec29a4aff3153f258beae050049e899f985000277b0bb6502ee7a784812791e9051c9991c593721eb8e366e01ff2b425b4162e
SSDEEP 12288:PptV8uc0KS9gpC1GIBv9PmgfKP1KJqbr:PpI2Krp9IaTYJqbr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.973

Botnet

BB03

Campaign

1666073717

190.199.99.171:993
41.69.192.245:443
167.58.254.85:443
206.1.172.1:443
5.163.177.234:443
134.35.0.103:443
105.96.221.136:443
41.101.100.7:443
186.177.93.18:2222
78.179.135.247:443
177.205.74.14:2222
102.47.218.41:443
102.156.149.226:443
41.250.48.206:443
41.107.58.251:443
187.198.16.39:443
193.201.187.64:443
41.102.134.89:443
102.159.77.134:995
105.159.49.123:995
197.200.236.69:443
154.247.82.36:443
37.37.80.2:3389
190.11.198.76:443
197.158.87.248:443
186.188.96.197:443
82.12.196.197:443
91.171.72.214:32100
72.88.245.71:443
84.220.94.231:443
151.251.50.117:443
105.154.56.232:995
41.107.116.19:443
159.192.204.135:443
177.152.65.142:443
176.45.35.243:443
104.233.202.195:443
149.126.159.254:443
181.56.171.3:995
200.93.11.28:2222
163.182.177.80:443
72.21.109.1:443
190.193.180.228:443
190.204.112.207:2222
41.97.56.102:443
206.1.208.223:2087
41.251.219.50:443
105.111.141.73:443
190.39.218.17:443
190.100.149.122:995
196.64.70.216:443
196.89.213.40:995
181.168.145.94:443
187.101.200.186:995
41.105.245.174:443
179.25.144.177:995
94.52.127.44:443
186.18.210.16:443
102.158.215.180:443
78.183.238.79:443
197.1.50.150:443
42.189.32.186:80
14.54.83.15:443
71.239.12.136:443
112.70.141.221:443
37.245.136.135:2222
88.232.10.69:443
41.98.250.65:443
82.205.9.34:443
196.64.239.75:443
37.8.68.1:443
197.1.248.244:443
197.2.139.7:443
79.45.134.162:22
182.183.211.163:995
154.246.14.94:443
144.86.17.168:443
182.185.29.69:995
160.177.47.116:6881
181.197.41.173:443
160.248.194.147:443
85.109.221.97:443
125.25.77.249:995
125.26.173.215:443
197.10.195.7:443
45.160.33.163:443
202.170.206.61:995
96.9.66.118:995
132.251.244.227:443
113.188.13.246:443
78.181.39.116:443
1.53.101.75:443
31.201.40.194:443
197.116.178.224:443
79.155.159.177:443
181.188.164.123:443
156.221.50.226:995
41.251.15.7:990
45.240.140.233:995
189.243.187.76:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  Originals.lnk
- Size 1KB
- SHA256 35a446d6961e2dfac55be5c60713e86172e5746bc984002a6d04747b66578731
- MD5 66a8168164f88a724e0a6b0a34d39842
- SHA1 125017cb152593ecf1a168f785f80bd809ab91af
- SHA512 8276bc76ce7de48b6116801caeacf35d1dd573f733b7de52d60bb5e9893511381123b0aee2d7927c6c1421ffa35e84802fa665369b0f4c629268484d12aaade9
- MD5 SHA1 SHA512
Score

10^/10

qakbot bb03 1666073717 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2
- Target
  carcasses/peg.des
- Size 561KB
- SHA256 319b660e3224b3c5f9ec19645ef1b05c8c91f70ebe3235d55d4c86f47eccdbbd
- MD5 955bc30695dd32875e5b1f3c6517b935
- SHA1 9b5c5d21a15a7e66cc897299296d9f05b0d7d1b9
- SHA512 24f8c0c97bd40520be5499648967c653ea92a1927f833b8d758788242329fec949aefb36b394ba559becfedf799e0ad07c579ad38d7dfb2b1608def27504471d
- SSDEEP 6144:ypIe6W8uc0KxlK9gpC1d88LKXeAOkuL9P5Qt6frqLwYzbn4NKToC2HD9qFmq:yptV8uc0KS9gpC1GIBv9PmgfKP1KJq
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot bb03 1666073717 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral3 behavioral4
- Target
  carcasses/virtuosity.cmd
- Size 402B
- SHA256 a4cfc0f90711d94416229c3ab08e541d0eff351e00af393a5ad994a21c0e50b9
- MD5 f7494e15a823df4497d98e875709aa46
- SHA1 4b292cab5508d8a0c3a6f5b005031e292ba54f19
- SHA512 ce2dc897dd3418bef5b2e0591a25a1b1e4b6962f9351144e0774e2d932466fd9e3ad261c5b6af4819d52c62c1024f94e78c6c2333be03c2b62609387ad821bb2
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Qakbot/Qbot

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6