qakbot | 10a646a224e4b892e691bf13ae24c48b8ad73be7e28174109bfbd14bf25f2e9b

Resubmissions

12-11-2022 09:22

221112-lcbfxaef65 10

02-11-2022 05:32

221102-f8allaadak 10

02-11-2022 05:09

221102-fte8jaacbj 1

Sharing

Copy URL

Twitter E-mail

General

Target

96679b5e-98b5-4fad-8b60-fe8d7b3a850e.html
Size

942KB
Sample

221102-f8allaadak
MD5

7b72e2f10375299854242376e4c8336a
SHA1

708d16ed7fb4f9655d45a1e3fd1d1b2a431f7296
SHA256

10a646a224e4b892e691bf13ae24c48b8ad73be7e28174109bfbd14bf25f2e9b
SHA512

36f20b0fc06e3ffe00ca02157590aed5aa69bf5a491fcdf324ab5579025f622deb88a4f57bc18c153e00d2fba3ee84b5fbceac81f6ed19890c22fcf8c9c8e716
SSDEEP

12288:pDe/u2Q1jSv6pyXVNrnOW1yJ1+Wlsr5eIX3Wq63U+/7x3AZSx/bo0tLRVe:M/uVSizJJMW6He/7dAZSrRRVe

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  
  96679b5e-98b5-4fad-8b60-fe8d7b3a850e.html
- Size
  
  942KB
- MD5
  
  7b72e2f10375299854242376e4c8336a
- SHA1
  
  708d16ed7fb4f9655d45a1e3fd1d1b2a431f7296
- SHA256
  
  10a646a224e4b892e691bf13ae24c48b8ad73be7e28174109bfbd14bf25f2e9b
- SHA512
  
  36f20b0fc06e3ffe00ca02157590aed5aa69bf5a491fcdf324ab5579025f622deb88a4f57bc18c153e00d2fba3ee84b5fbceac81f6ed19890c22fcf8c9c8e716
- SSDEEP
  
  12288:pDe/u2Q1jSv6pyXVNrnOW1yJ1+Wlsr5eIX3Wq63U+/7x3AZSx/bo0tLRVe:M/uVSizJJMW6He/7dAZSrRRVe
Score

10^/10

qakbot obama217 1666765529 banker persistence stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1