General
-
Target
3b82d74f50dc7ebf5236aa37ecd6d70229715a8b3ae79562100a7d3b7905919c.zip
-
Size
362KB
-
Sample
221118-1q7tlahh95
-
MD5
190c786bca1bd89e856f2760c33596bc
-
SHA1
dceb758742fa6eec6e9ae98e2dbcfdf8b7a4a0c1
-
SHA256
3b82d74f50dc7ebf5236aa37ecd6d70229715a8b3ae79562100a7d3b7905919c
-
SHA512
83f1157d30490dde4a27c81ee5c28a6e3903ee0f07936a6de72654d50d935f82bf24e9590c26c33bb4c39244faffcc3abb753e52de1cef4185e814ad54b9b463
-
SSDEEP
6144:OgFfJcxQP84hPdO+cDA9W1KcPmo4DryTFSX+5yBY9IF+g173Bqo5C2PzIvy886:Og1JrP84hPdhcq0mokycuAuOxB3k2PzO
Malware Config
Extracted
qakbot
404.30
BB06
1668752705
98.147.155.235:443
49.175.72.56:443
82.31.37.241:443
73.36.196.11:443
2.84.98.228:2222
188.54.79.88:995
184.153.132.82:443
74.66.134.24:443
172.117.139.142:995
12.172.173.82:990
24.64.114.59:3389
12.172.173.82:2087
78.92.133.215:443
24.64.114.59:2222
50.68.204.71:995
105.184.161.242:443
12.172.173.82:22
221.161.103.6:443
98.145.23.67:443
73.161.176.218:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
OB76.img
-
Size
842KB
-
MD5
e44811e8afd7e0227dfa35ff28643752
-
SHA1
6378e72d856b153affaf3caf44a89f19b008f1a8
-
SHA256
5a0f6ebc772c3a8897ba35aafba430f1fd262320f290b42764988d2c9c5454f4
-
SHA512
14a50038fc9d8aed163b88861f5ecc346d0a1b7f25988d061f530b48c5143bd9131740a5468a5cf9caf831165f5cea294802b32d8ce2072cecfcd4541e494550
-
SSDEEP
24576:ENdpWbYGQajBp6Pi1YWaw46K8zWcCTiUQsC3:YUbzQaNpx1DaIK8Iq3
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-