General
-
Target
CD21.img
-
Size
970KB
-
Sample
221118-hcw6tscf7s
-
MD5
c554bd7e4ad745497718695fa006201e
-
SHA1
6eb7fbdd293e9b3ead6d6f91bf6f0a93e36ce98f
-
SHA256
7333f51c6d2fb4d10522d083b8f47ff2340263057ca4719f1bc4c2edb66030eb
-
SHA512
ed9af9f259b385ed28f1b7c58a2cf9794c869b59c333e5273c37035aefa8b857959fac4af4073bdc3c584ecc610df5b1a6b2bde60f85d8a8f74519705e1531b2
-
SSDEEP
12288:ZouKwnON76F+DfZxL4+Dir8lkQ5z4hbNmKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:ZouKwW6F+DRt4Tr8lkBhpp2QOUZ
Malware Config
Extracted
qakbot
404.30
BB06
1668670510
86.225.214.138:2222
71.183.236.133:443
182.66.197.35:443
70.66.199.12:443
76.80.180.154:995
180.151.104.143:443
92.149.205.238:2222
83.110.223.247:443
183.87.31.34:443
105.103.50.1:990
103.141.50.117:995
105.103.50.1:465
105.103.50.1:22
86.130.9.167:2222
86.99.15.243:2222
90.104.22.28:2222
172.117.139.142:995
176.142.207.63:443
142.161.27.232:2222
71.247.10.63:50003
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
CD21.img
-
Size
970KB
-
MD5
c554bd7e4ad745497718695fa006201e
-
SHA1
6eb7fbdd293e9b3ead6d6f91bf6f0a93e36ce98f
-
SHA256
7333f51c6d2fb4d10522d083b8f47ff2340263057ca4719f1bc4c2edb66030eb
-
SHA512
ed9af9f259b385ed28f1b7c58a2cf9794c869b59c333e5273c37035aefa8b857959fac4af4073bdc3c584ecc610df5b1a6b2bde60f85d8a8f74519705e1531b2
-
SSDEEP
12288:ZouKwnON76F+DfZxL4+Dir8lkQ5z4hbNmKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:ZouKwW6F+DRt4Tr8lkBhpp2QOUZ
Score3/10 -
-
-
Target
WW.js
-
Size
9KB
-
MD5
b67751cea7af1a7268bedb0f6e7f7b17
-
SHA1
bd509723acbde1de76812dac77bb61fcb64d59d2
-
SHA256
b756624e793457d7ee47a6f34e23c331d4e9b3c493d1216ade21c7406f15c049
-
SHA512
a4b323b77bd28ac8385cc2922dabfd1fb0147178387e3b225afb49e6649adc15f5924b7cf026166a7cbbc5ca584bd36c2849b16d1e049e82bfde057e690e410e
-
SSDEEP
192:USLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:DVq2k785UIro8KTMhSeYm5P2jiuuEjP4
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
animators/sidecars.tmp
-
Size
835KB
-
MD5
d76bc49633972c19bc6360adba9f7be7
-
SHA1
6b273ab204e72d5b97cb8bcee3f5f006190918e2
-
SHA256
adbd67491d5f789891d1daf9682a69995522a245f1c6c8fac5ceba8aa41eec18
-
SHA512
5a251152971ddb4f20caf40c32bcfde118a624b6080ae9e2058cba03acb3a3ee1fb7542e1fd7703794e1daf2679f449bd628b70d018f97dcdbc4fe09b89a72d9
-
SSDEEP
12288:T6F+DfZxL4+Dir8lkQ5z4hbNmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:T6F+DRt4Tr8lkBhpp2QOU
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-