General
-
Target
LO30.img
-
Size
848KB
-
Sample
221117-spkzfaag3x
-
MD5
ea66dc4ed9a8b6bdc468355bea047eb2
-
SHA1
c257365c246ecbfea389e2a93551a91b608f1c95
-
SHA256
2b3c1cbe5454771e83d7f7a8571ed08a5e23ade79acb9596527a5bc5353351d1
-
SHA512
e80e568ac5efb8fd0f731940c7b432513ef498d833e431853cd080cfd348292bcd1f9ce5dcfc2f9bfab2d31f3570f96fb7c05f92d47834c7eb48c222093ae0da
-
SSDEEP
12288:xoDjGfBlhYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9QVN9:xoDjkzW8wWpD9u/VLM9Xq4nQVN9
Malware Config
Extracted
qakbot
404.30
BB06
1668683197
23.240.47.58:995
12.172.173.82:465
91.169.12.198:32100
94.63.65.146:443
80.13.179.151:2222
64.207.237.118:443
24.206.27.39:443
83.114.60.6:2222
86.171.75.63:443
86.195.32.149:2222
170.253.25.35:443
92.185.204.18:2078
157.231.42.190:995
170.249.59.153:443
174.101.111.4:443
116.74.163.152:443
76.80.180.154:995
180.151.104.143:443
86.130.9.167:2222
86.99.15.243:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
LO30.img
-
Size
848KB
-
MD5
ea66dc4ed9a8b6bdc468355bea047eb2
-
SHA1
c257365c246ecbfea389e2a93551a91b608f1c95
-
SHA256
2b3c1cbe5454771e83d7f7a8571ed08a5e23ade79acb9596527a5bc5353351d1
-
SHA512
e80e568ac5efb8fd0f731940c7b432513ef498d833e431853cd080cfd348292bcd1f9ce5dcfc2f9bfab2d31f3570f96fb7c05f92d47834c7eb48c222093ae0da
-
SSDEEP
12288:xoDjGfBlhYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9QVN9:xoDjkzW8wWpD9u/VLM9Xq4nQVN9
Score3/10 -
-
-
Target
WW.js
-
Size
9KB
-
MD5
769c52571f315c856e160436e765e8eb
-
SHA1
faa334cbe24cfa31a19e1b0662e1b3230db284c6
-
SHA256
082316a8ddd6ecbc299f5259f7433610278bac7bf616bb33bd5b22808ea65134
-
SHA512
cbc2953b41d4dd6d5c003d0b7ffab5af6e4999f0afba7a057017dd076873c7576e7cbe0828dda000cacef181242e2bc9e04156a26d23cdaf151851fdd3b9188c
-
SSDEEP
192:jFSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:UVq2k785UIro8KTMhSeYm5P2jiuuEjP4
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
port/enmity.tmp
-
Size
691KB
-
MD5
8874e4ac299c3a10310127ff57e64fe9
-
SHA1
a7e6817317a0748d09c91fa076d5a5317fdd816c
-
SHA256
5262a6c97fb7ed4967b2d7a82f414fca2de65d6a7a072851a1dcd220a02d1f2e
-
SHA512
b3f26e1446c0cd093fb2ed79aa93fc11e4bdac7a745231f93e4bce96fc7b0137b75b2eeeb94008f896961faa6173db64dfd41c76e7df0c54eb778f591d030b24
-
SSDEEP
12288:sjGfBlhYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sjkzW8wWpD9u/VLM9Xq4n
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-