General
- Target CO7917.iso
- Size 1.8MB
- Sample221101-brdvgafgfl
- SHA256 967af76e6be779d060174f3e3231bd8e3f88b3af26043952bcf67146ca750756
Score
10/10
Malware Config
Extracted
Family
-
qakbot
Version
-
404.14
Botnet
-
BB05
Campaign
-
1667208557
C2
-
174.77.209.5:443
-
187.0.1.74:23795
-
24.206.27.39:443
-
1.156.220.169:30723
-
156.216.39.119:995
-
58.186.75.42:443
-
1.156.197.160:30467
-
187.1.1.190:4844
-
186.18.210.16:443
-
1.181.56.171:771
-
90.165.109.4:2222
-
187.0.1.186:39742
-
87.57.13.215:443
-
187.0.1.207:52344
-
227.26.3.227:1
-
98.207.190.55:443
-
187.0.1.197:7017
-
188.49.56.189:443
-
102.156.160.115:443
-
187.0.1.24:17751
Attributes
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
- Target CO.lnk
- Size 1KB
- SHA256 5df2756a7d76d95678704d977c845838e8e3d9829303cbacf6862992824de4bc
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
- Target judicature/stereotypes.dat
- Size 1.6MB
- SHA256 d7d2cf77d905a0e182948d7df8ee7e8fc63538bd98ea3a3ff0548ecb25da61c1
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
- Target judicature/unfurled.cmd
- Size 706B
- SHA256 90a012105ead69186390230ee02c7aef3502f5efe2e38f488902451dd5dc1525
Score1/10