General
-
Target
ZN89.img
-
Size
970KB
-
Sample
221118-as7cqsgc27
-
MD5
9e8d69daed1345c197150ef103a59251
-
SHA1
b27eab40c99ebc0cbfb6a8c01af7e4ebc64e6c10
-
SHA256
9020250778de1720c3f97307f58baf9737dcf7af7969fd495e35bf97123f33a2
-
SHA512
5cbd3d24e90cad2ebac6c06ccb22b2f631fbb51460c40312f8b258b1d138a4455032de7bc76e0eb28c1b7d4f00289a6f7f652fef8b864f8df2df384b016a354d
-
SSDEEP
12288:noeKwnON76F+DfZxL4+Dir8lkQ5z4hbsmKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:noeKwW6F+DRt4Tr8lkBhgp2QOUZ
Malware Config
Extracted
qakbot
404.30
BB06
1668670510
86.225.214.138:2222
71.183.236.133:443
182.66.197.35:443
70.66.199.12:443
76.80.180.154:995
180.151.104.143:443
92.149.205.238:2222
83.110.223.247:443
183.87.31.34:443
105.103.50.1:990
103.141.50.117:995
105.103.50.1:465
105.103.50.1:22
86.130.9.167:2222
86.99.15.243:2222
90.104.22.28:2222
172.117.139.142:995
176.142.207.63:443
142.161.27.232:2222
71.247.10.63:50003
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
ZN89.img
-
Size
970KB
-
MD5
9e8d69daed1345c197150ef103a59251
-
SHA1
b27eab40c99ebc0cbfb6a8c01af7e4ebc64e6c10
-
SHA256
9020250778de1720c3f97307f58baf9737dcf7af7969fd495e35bf97123f33a2
-
SHA512
5cbd3d24e90cad2ebac6c06ccb22b2f631fbb51460c40312f8b258b1d138a4455032de7bc76e0eb28c1b7d4f00289a6f7f652fef8b864f8df2df384b016a354d
-
SSDEEP
12288:noeKwnON76F+DfZxL4+Dir8lkQ5z4hbsmKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:noeKwW6F+DRt4Tr8lkBhgp2QOUZ
Score3/10 -
-
-
Target
WW.js
-
Size
9KB
-
MD5
bcb9892b516c84743679ae3e5b7b140b
-
SHA1
de8535bf66f297607d1e396f0dffec1c08cacbf1
-
SHA256
4884dbd1e84c7c42f08a3835f6ea3b6d7f4833335df7c207da8547a2de6be527
-
SHA512
24b75fa4febd9af33d3f58f99cf05527d6842ec32bc47ccf673281d1acf7d6e1a5caf010a7106ab3b3b89bea9c13f3f591d742cade8505d96adb2ed39e721b70
-
SSDEEP
192:NSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:oVq2k785UIro8KTMhSeYm5P2jiuuEjP4
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
animators/participates.tmp
-
Size
835KB
-
MD5
d06e0e54a6d4c8a7996f1e2619f1efdf
-
SHA1
d689846c783af6786748dce785a422aaeb73bb6c
-
SHA256
ed974b2b9e7dd9d96977e605f474f3ba8cfa4b1dbc9f12bbfabda9e06c7b39a7
-
SHA512
1323e002dbeffd6a8ca50b9e0f697d1a783c3fcc7315666f26ce5fd3100a4b9b575d480e6da02cfd73191e5b804c969c3e176bd16dc229561549463cf1dd9c38
-
SSDEEP
12288:T6F+DfZxL4+Dir8lkQ5z4hbsmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:T6F+DRt4Tr8lkBhgp2QOU
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-