qakbot | 085f0f3f25b1328d153a7c56125e1d8a4d43bc882fe3f250d742ea5247850c02

Sharing

Copy URL Twitter E-mail

General

Target
hindmost.temp.dll
Size 1.0MB
Sample221122-twcr3sdd6y
SHA256 085f0f3f25b1328d153a7c56125e1d8a4d43bc882fe3f250d742ea5247850c02
MD5 09a815f48d8a5319d88f2b8b2e4b02ab
SHA1 e6601cb30205c8e790ac4511f0d6362b80dbb9f5
SHA512 5ba1578fe2203155bfcdda248c2d8a2cce3799f0e45c36ea952b7043b3c4436c1c53daec69cdf8d00a98638bb63220310ab060e0c8f28cc051d0b76b99eafebf
SSDEEP 24576:AXYkbOvnDF9dnJEd+5F6bRGiJzN8gvd4rmwd2eZL/v2mWG2mWYY:XHnDF9dnJEd+5F6bR/JzN863q/v2mWGl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB07

Campaign

1669024152

69.119.123.159:2222
197.148.17.17:2078
174.104.184.149:443
12.172.173.82:995
91.68.227.219:443
85.241.180.94:443
83.7.53.150:443
213.22.188.57:2222
71.46.234.170:443
190.75.150.58:2222
86.98.15.100:995
89.115.196.99:443
83.31.254.67:2222
46.162.109.183:443
2.84.98.228:2222
78.69.251.252:2222
12.172.173.82:465
75.143.236.149:443
47.229.96.60:443
80.121.8.212:995
74.92.243.113:50000
86.225.214.138:2222
183.82.100.110:2222
86.175.128.143:443
105.103.41.128:990
121.122.99.151:995
82.121.237.106:2222
83.248.199.56:443
81.156.198.115:2222
24.228.132.224:2222
87.243.146.59:443
174.112.25.29:2078
84.35.26.14:995
174.45.15.123:443
83.110.90.214:995
87.65.160.87:995
172.90.139.138:2222
71.247.10.63:2083
47.41.154.250:443
80.103.77.44:2222
92.11.189.236:2222
81.229.117.95:2222
91.169.12.198:32100
62.31.130.138:465
188.92.64.68:443
58.186.75.42:443
85.59.61.52:2222
94.63.65.146:443
80.13.179.151:2222
24.206.27.39:443
170.253.25.35:443
157.231.42.190:995
184.153.132.82:443
174.101.111.4:443
23.240.47.58:995
217.128.91.196:2222
62.35.67.88:443
184.155.91.69:443
86.176.144.202:2222
86.213.224.109:2222
90.104.22.28:2222
76.80.180.154:995
174.77.209.5:443
184.176.154.83:995
58.247.115.126:995
69.133.162.35:443
71.183.236.133:443
102.47.130.52:995
103.141.50.117:995
116.75.63.124:443
70.66.199.12:443
92.185.204.18:2078
130.43.107.232:995
92.24.200.226:995
81.111.108.123:443
98.145.23.67:443
197.0.235.159:443
92.137.74.174:2222
92.207.132.174:2222
12.172.173.82:50001
76.127.192.23:443
12.172.173.82:21
176.142.207.63:443
83.110.223.247:443
71.247.10.63:50003
108.6.249.139:443
24.69.87.61:443
90.89.95.158:2222
89.129.109.27:2222
91.254.215.167:443
71.247.10.63:995
47.34.30.133:443
86.130.9.140:2222
70.64.77.115:443
87.223.80.45:443
180.151.104.143:443
109.57.68.154:443
103.55.67.180:443
75.99.125.238:2222
50.68.204.71:995
73.36.196.11:443
105.184.161.242:443
187.199.224.16:32103
105.103.41.128:32103
75.156.125.215:995
170.249.59.153:443
2.91.187.6:995
87.202.101.164:50000
105.103.41.128:465
74.66.134.24:443
172.117.139.142:995
87.1.202.122:443
105.103.41.128:2078
12.172.173.82:990
86.171.75.63:443
12.172.173.82:2087
105.103.41.128:22
24.142.218.202:443
66.191.69.18:995
45.248.169.101:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  hindmost.temp.dll
- Size 1.0MB
- SHA256 085f0f3f25b1328d153a7c56125e1d8a4d43bc882fe3f250d742ea5247850c02
- MD5 09a815f48d8a5319d88f2b8b2e4b02ab
- SHA1 e6601cb30205c8e790ac4511f0d6362b80dbb9f5
- SHA512 5ba1578fe2203155bfcdda248c2d8a2cce3799f0e45c36ea952b7043b3c4436c1c53daec69cdf8d00a98638bb63220310ab060e0c8f28cc051d0b76b99eafebf
- SSDEEP 24576:AXYkbOvnDF9dnJEd+5F6bRGiJzN8gvd4rmwd2eZL/v2mWG2mWYY:XHnDF9dnJEd+5F6bR/JzN863q/v2mWGl
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot bb07 1669024152 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2