qakbot | 1821daab4216388a07240299c9d93478a49874b5c776e297e27fc4d7553229fa

Sharing

Copy URL Twitter E-mail

General

Target
ContractCopy_YZ62.img
Size 1.2MB
Sample221119-g7k7dagg25
SHA256 1821daab4216388a07240299c9d93478a49874b5c776e297e27fc4d7553229fa
MD5 f7ca9a8048e534b3fcb6c8f66654e63a
SHA1 3e7d3cd4fb07b0f3d3305afdc18e1a57b0d34a3a
SHA512 a36dc6b0ac552ff1742b8b69f34bc50feb4925d3de077993c246093f7ce74910198ebd92469e473ccab356ef36c40772992bed70ea336020f5ce2b30d1df6e3a
SSDEEP 24576:5oGd7QUoTzEWdfwTTn3M9XqdXJDi317qne:BVU4Wdf6M9XmXFi317qne
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama222

Campaign

1668692319

105.184.161.242:443
73.36.196.11:443
82.31.37.241:443
24.116.45.121:443
213.67.255.57:2222
200.93.14.206:2222
188.54.79.88:995
87.220.205.14:2222
72.88.245.71:443
92.137.74.174:2222
91.68.227.219:443
184.153.132.82:443
74.66.134.24:443
47.16.73.77:2222
41.97.183.39:443
177.205.92.100:2222
24.64.114.59:3389
105.111.45.51:995
86.180.222.237:2222
76.184.95.190:993
142.119.40.220:2222
92.27.86.48:2222
180.156.240.239:995
73.230.28.7:443
176.151.15.101:443
24.64.114.59:2222
86.165.15.180:2222
66.191.69.18:995
64.121.161.102:443
50.90.249.161:443
70.115.104.126:995
99.238.106.45:443
72.140.137.221:443
174.77.209.5:443
174.104.184.149:443
2.84.98.228:2222
76.127.192.23:443
50.68.204.71:443
109.11.175.42:2222
199.83.165.233:443
85.59.61.52:2222
85.139.176.42:2222
157.231.42.190:443
85.74.158.150:2222
12.172.173.82:2087
109.152.70.207:50000
12.172.173.82:22
50.68.204.71:995
45.248.169.101:443
76.20.42.45:443
2.8.39.175:2222
81.250.33.243:2222
213.91.235.146:443
136.35.241.159:443
82.121.73.56:2222
173.239.94.212:443
184.20.10.236:443
187.199.224.16:32103
183.82.100.110:2222
102.156.113.77:443
75.99.125.238:2222
82.121.237.106:2222
79.37.204.67:443
85.241.180.94:443
217.128.91.196:2222
12.172.173.82:443
91.180.68.95:2222
98.187.21.2:443
82.9.210.36:443
181.118.183.116:443
174.45.15.123:443
2.83.62.105:443
84.113.121.103:443
77.126.81.208:443
92.106.70.62:2222
12.172.173.82:993
212.251.122.147:995
102.157.69.217:995
69.119.123.159:2222
47.176.30.75:443
87.223.80.45:443
174.60.47.98:443
173.32.181.236:443
41.228.223.122:995
82.36.36.76:443
154.247.94.160:32103
12.172.173.82:50001
12.172.173.82:995
172.90.139.138:2222
86.175.128.143:443
75.143.236.149:443
75.98.154.19:443
81.156.198.115:2222
80.121.8.212:995
103.55.67.180:443
89.152.120.181:443
83.79.150.24:2222
74.92.243.113:50000
87.220.68.51:2222
69.133.162.35:443
80.103.77.44:2222
61.92.123.169:443
74.33.84.227:443
86.225.214.138:2222
80.189.213.49:2222
188.92.64.68:443
109.145.27.139:443
121.122.99.151:995
47.185.141.97:443
81.229.117.95:2222
84.35.26.14:995
68.47.128.161:443
71.31.101.183:443
75.191.246.70:443
41.35.196.18:995
87.65.160.87:995
88.126.94.4:50000
102.158.230.141:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  ContractCopy_YZ62.img
- Size 1.2MB
- SHA256 1821daab4216388a07240299c9d93478a49874b5c776e297e27fc4d7553229fa
- MD5 f7ca9a8048e534b3fcb6c8f66654e63a
- SHA1 3e7d3cd4fb07b0f3d3305afdc18e1a57b0d34a3a
- SHA512 a36dc6b0ac552ff1742b8b69f34bc50feb4925d3de077993c246093f7ce74910198ebd92469e473ccab356ef36c40772992bed70ea336020f5ce2b30d1df6e3a
- SSDEEP 24576:5oGd7QUoTzEWdfwTTn3M9XqdXJDi317qne:BVU4Wdf6M9XmXFi317qne
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1 behavioral2
- Target
  ContractCopy.js
- Size 9KB
- SHA256 fbe4408e0c0a528f331fc002f785eff7ad16f45ae3ea3ab94eb8b3cbf0c6f00f
- MD5 599ff2df10ec1a8497d760784e493885
- SHA1 0b6342b8c43c76fbde2e714c2a7cda2bd1260d05
- SHA512 08e93e1117220b0edc589505e5d3bba99c408deb5d9ce197df864cecf838a815850d9b3a0d5c6fef9ab86396bf5af230c9b1f58f3fdbfeb7db339f97bbc15dd5
- SSDEEP 192:GSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:BVq2k785UIro8KTMhSeYm5P2jiuuEjP4
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot obama222 1668692319 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  addled/soloists.tmp
- Size 781KB
- SHA256 5f715c36aa0f2e60500bbc501eaacdb1e95ed38959f03a38e52009d3ec2a864f
- MD5 b60b9fedc3fcf9011446349ab6430719
- SHA1 e706be44c0bf3cf12ee1b357b0d037f172a5220a
- SHA512 bd226954a1e8d72bafa2c5c6ac7e001b74284d1f09e785c8323bb96f4fa0b7694eb2d8105b4741438907b49c6b9e298d692652f95a31190abf7ce0a2c5fa5922
- SSDEEP 12288:3+ed7zMD42lTz4kg3Wdf8+wawM375RGyin7ZlUP9XqcYX:Zd7QUoTzEWdfwTTn3M9XqdX
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot obama222 1668692319 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral5 behavioral6

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Checks computer location settings

Qakbot/Qbot

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6