qakbot | 501e90d690942737a5c6756efd9553e8c553455681a448a12483e6227073aa9d

Sharing

Copy URL Twitter E-mail

General

Target
TY-756.zip
Size 384KB
Sample221129-gva6mscd35
SHA256 501e90d690942737a5c6756efd9553e8c553455681a448a12483e6227073aa9d
MD5 1da5f7cdaf51648ca6370a7c3be4788d
SHA1 a353510b2a43264a276361b68622be896f95f5af
SHA512 cacd55040aea88a96cbbc81e6ff65c67296ec1faadbe131a28e95cda86f1e2526f6a1cf1a5bab270c03ca15c24f66561c59d93646f7b947fad8a46d33eed065c
SSDEEP 12288:7g1pbBmMnMGYUlSmqkR2lB6qcdWfe3+PvenASI5Le6M:49MGp7qpBEffArM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB08

Campaign

1669628564

98.147.155.235:443
85.52.73.34:2222
75.158.15.211:443
2.91.184.252:995
92.106.70.62:2222
85.152.152.46:443
86.159.48.25:2222
217.128.91.196:2222
92.11.189.236:2222
83.92.85.93:443
2.83.62.105:443
93.24.192.142:20
76.20.42.45:443
24.64.114.59:2078
73.36.196.11:443
130.43.99.103:995
172.117.139.142:995
100.16.107.117:443
12.172.173.82:22
176.151.15.101:443
50.68.204.71:443
58.162.223.233:443
50.68.204.71:993
108.162.6.34:995
24.142.218.202:443
174.112.25.29:2078
190.207.253.41:2222
66.191.69.18:995
85.241.180.94:443
149.126.159.106:443
75.141.227.169:443
31.167.227.31:443
173.18.126.3:443
184.153.132.82:443
176.142.207.63:443
82.9.210.36:443
87.221.197.110:2222
174.104.184.149:443
98.145.23.67:443
12.172.173.82:993
24.64.114.59:2222
116.75.63.225:443
136.232.184.134:995
77.126.81.208:443
62.31.130.138:465
75.99.125.235:2222
173.239.94.212:443
92.186.69.229:2222
92.24.200.226:995
109.218.104.206:2222
87.223.85.4:443
24.206.27.39:443
69.119.123.159:2222
64.121.161.102:443
91.169.12.198:32100
58.247.115.126:995
187.199.224.16:32103
123.3.240.16:995
122.178.197.139:995
102.156.232.220:443
12.172.173.82:995
92.98.228.28:2222
86.98.182.30:2222
90.116.219.167:2222
92.27.86.48:2222
93.156.103.241:443
85.7.61.22:2222
105.109.140.201:32103
86.225.214.138:2222
76.100.159.250:443
93.147.235.8:443
75.143.236.149:443
94.63.65.146:443
74.92.243.113:50000
75.98.154.19:443
216.196.245.102:2222
83.110.223.247:443
121.122.99.223:995
70.120.228.205:2083
47.229.96.60:443
86.171.75.63:443
89.129.109.27:2222
136.244.25.165:443
92.137.74.174:2222
78.69.251.252:2222
175.205.2.54:443
12.172.173.82:465
92.185.204.18:2078
58.186.75.42:443
76.80.180.154:995
84.35.26.14:995
190.18.236.175:443
47.41.154.250:443
190.11.198.66:443
81.229.117.95:2222
190.39.199.51:443
197.3.64.204:995
213.67.255.57:2222
86.195.32.149:2222
70.115.104.126:995
24.64.114.59:3389
216.196.245.102:2083
108.162.6.34:443
50.90.249.161:443
170.253.25.35:443
103.144.201.62:2078
24.64.114.59:50010
23.240.47.58:995
45.248.169.101:443
92.239.81.124:443
83.21.138.251:2222
80.13.179.151:2222
184.155.91.69:443
193.154.207.221:443
90.104.22.28:2222
71.247.10.63:50003
108.6.249.139:443
184.176.154.83:995
174.77.209.5:443
100.8.168.108:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  AS.js
- Size 138B
- SHA256 a1abe2c6dbccaaa6a04fbbc903043d2e2bb14e1534204ccbaf6b059ee754a2b0
- MD5 eea6049b9b99e426d7cec90efad09b2a
- SHA1 7431fd7b9ceff2ca3ccd6d57c4ddbd6072d97788
- SHA512 2002bc44d80d8c38e6fd1cd6daeb550a0ebe502163cab58648473f68e30e2a976c5e12948fd7da074b01999f6c3aa463b9088e29d63a631c2ce4fd790b9c4208
- MD5 SHA1 SHA512
Score

10^/10

qakbot bb08 1669628564 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2
- Target
  fix/unwatermarked.ps1
- Size 369B
- SHA256 056deb6e3f5de68f9ae2b1ed11f7d3d398a3488387294937bebcb0f8f847b5c9
- MD5 ee1dae7f9bc8d29ac9de9c0482413600
- SHA1 b8228275bd599badebaf9206f0328b2439f8599c
- SHA512 de24d1a6c95206d71ef0d75b1ea2f202b97ac168170809eab298be028c61374a989809e5ac0c6da84a3edd989a8dd166c21ac230e5c073e94181022886534b93
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  fix/veronica.js
- Size 138B
- SHA256 a1abe2c6dbccaaa6a04fbbc903043d2e2bb14e1534204ccbaf6b059ee754a2b0
- MD5 eea6049b9b99e426d7cec90efad09b2a
- SHA1 7431fd7b9ceff2ca3ccd6d57c4ddbd6072d97788
- SHA512 2002bc44d80d8c38e6fd1cd6daeb550a0ebe502163cab58648473f68e30e2a976c5e12948fd7da074b01999f6c3aa463b9088e29d63a631c2ce4fd790b9c4208
- MD5 SHA1 SHA512
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Checks computer location settings

Loads dropped DLL

Checks computer location settings

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6