qakbot | 4153a179adec63180997585a07dcd08b374781ca73c3b649173976d3d0078b96

Resubmissions

18/11/2022, 14:32

221118-rwm7psde3t10

18/11/2022, 14:26

221118-rrwchshe8310

Sharing

Copy URL Twitter E-mail

General

Target
OB76.zip
Size 362KB
Sample221118-rrwchshe83
SHA256 4153a179adec63180997585a07dcd08b374781ca73c3b649173976d3d0078b96
MD5 f860cc2f0664f9a86d87058f02aa8a42
SHA1 b37f6be3df4e13f0183ef586bba5e4a42924a675
SHA512 64c434edb56d3d056d27b82d750054ea9a4011587e8f97cb3b4be8365b7fed6b25c6676de2920c9e01a0a091199b2b3c0da3e7b8788bd3f0be65f68070378c0b
SSDEEP 6144:ggFfJcxQP84hPdO+cDA9W1KcPmo4DryTFSX+5yBY9IF+g173Bqo5C2PzIvy88c:gg1JrP84hPdhcq0mokycuAuOxB3k2Pzo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668752705

98.147.155.235:443
49.175.72.56:443
82.31.37.241:443
73.36.196.11:443
2.84.98.228:2222
188.54.79.88:995
184.153.132.82:443
74.66.134.24:443
172.117.139.142:995
12.172.173.82:990
24.64.114.59:3389
12.172.173.82:2087
78.92.133.215:443
24.64.114.59:2222
50.68.204.71:995
105.184.161.242:443
12.172.173.82:22
221.161.103.6:443
98.145.23.67:443
73.161.176.218:443
50.68.204.71:443
24.142.218.202:443
66.191.69.18:995
183.82.100.110:2222
24.49.232.96:443
70.115.104.126:995
176.151.15.101:443
93.156.103.241:443
86.217.250.15:2222
12.172.173.82:443
173.18.126.3:443
157.231.42.190:443
92.24.200.226:995
187.199.224.16:32103
213.91.235.146:443
188.4.142.139:995
199.83.165.233:443
63.248.148.87:443
58.162.223.233:443
102.159.188.241:443
12.172.173.82:50001
174.45.15.123:443
86.171.75.63:443
75.99.125.238:2222
75.158.15.211:443
79.37.204.67:443
27.110.134.202:995
12.172.173.82:993
58.247.115.126:995
181.118.183.116:443
31.167.227.31:443
2.83.62.105:443
77.126.81.208:443
174.112.25.29:2222
92.106.70.62:2222
82.121.73.56:2222
173.239.94.212:443
213.191.164.70:443
130.43.107.232:995
12.172.173.82:995
71.46.234.170:443
109.11.175.42:2222
73.155.10.79:443
75.191.246.70:443
136.232.184.134:995
102.158.245.248:995
47.176.30.75:443
154.247.94.160:32103
103.141.50.117:995
69.119.123.159:2222
87.223.80.45:443
75.143.236.149:443
74.92.243.113:50000
74.33.84.227:443
86.225.214.138:2222
75.98.154.19:443
117.186.222.30:993
84.113.121.103:443
188.176.170.61:443
121.122.99.151:995
183.87.31.34:443
83.110.223.247:443
86.99.15.243:2222
78.69.251.252:2222
103.55.67.180:443
47.229.96.60:443
84.209.52.11:443
174.112.25.29:2078
84.35.26.14:995
99.253.115.160:443
68.47.128.161:443
87.65.160.87:995
172.90.139.138:2222
86.175.128.143:443
12.172.173.82:465
71.247.10.63:2083
47.41.154.250:443
71.31.101.183:443
81.229.117.95:2222
41.35.196.18:995
91.169.12.198:32100
94.63.65.146:443
80.13.179.151:2222
64.207.237.118:443
24.206.27.39:443
170.253.25.35:443
157.231.42.190:995
170.249.59.153:443
174.101.111.4:443
23.240.47.58:995
94.70.37.145:2222
72.200.109.104:443
99.229.146.120:443
158.62.157.184:443
184.155.91.69:443
80.0.74.165:443
24.4.239.157:443
76.80.180.154:995
176.142.207.63:443
69.133.162.35:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  SK.js
- Size 9KB
- SHA256 f17e6e6b3d207b58aff019871da14eb52aec46eaa7ca1a0409fb5b1f834d5c81
- MD5 78c2da9c44463c07818c0988ee2577af
- SHA1 609cfa708ba1c7a814a66c551d9ea33b9064f90d
- SHA512 d66d58b2ad84c7849ddb58933b9a9f200b368d7c642b760c84527b35cbc68ba891e03b5203fc893cc3b90ff2b5d53185fa0784527661caa4c792f530569ccc87
- SSDEEP 192:cPSLj50Tavgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5AJ:752k785UIhp/KTMhSeYmn2jiu5EjP+rs
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot bb06 1668752705 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  manacle/wined.temp
- Size 372KB
- SHA256 c1cc35bebc0eb78fcf54af484936adec1603fdce672c9ac919ef5e739f3a0fd8
- MD5 c5e7003aa6028dd3efb815b237eb8c20
- SHA1 4b55fe56e050613b110d5db2b8a8fe232a660dc7
- SHA512 6e914412e6c4a7c70acea44a0a2e1798e20d8e1f66b5aaf3eeb74046c1cb0362e4985f641f5456b2a85755f58f1f660b21acad25b1de0c347cf9b49ffd787991
- SSDEEP 6144:l1eKK1u77wiWjvM9gaYhWawPSxipTR9K1/XseDA+sqKD9oqHs9Dz/RJhKXuz:mKzMD2gaSWcxITi/XsZ+s7pohvRJhr
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot bb06 1668752705 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral3 behavioral4

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Checks computer location settings

Qakbot/Qbot

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4