qakbot | ad914a64e27ceb65f105dda2b9333507503acf7b5dfa24dcaf0eebed70e10c9b

Resubmissions

09-12-2022 21:31

221209-1c7lnsed59 10

01-12-2022 01:51

221201-b99d4ade82 10

01-12-2022 01:46

221201-b7b1tagf7t 3

Sharing

Copy URL

Twitter E-mail

General

Target

WT-163WP.iso
Size

101.2MB
Sample

221201-b99d4ade82
MD5

b650be9066248fd19bf55295a3dd91c1
SHA1

08dbe772979f2cf9b70637ecb4fbed0a29517b4a
SHA256

ad914a64e27ceb65f105dda2b9333507503acf7b5dfa24dcaf0eebed70e10c9b
SHA512

cd2dbb0d4addb80ff59126febd145b6a127378a6eadb18bdc3bffe8eab54b2db71352920c12be1882df88aa2eb8bd5b1d3b38124a4d607fabfd4194f380c3aaf
SSDEEP

24576:xFolOZ7iwCywfHH3vwLwZ0RV9Z0OEdMddz52kqAaBJP8fnLJ518VCqoI2ytH2:xFolOZ7iwCywfHH3vwLwDuDHAH2

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama224

Campaign

1669794048

75.161.233.194:995

216.82.134.218:443

174.104.184.149:443

173.18.126.3:443

87.202.101.164:50000

172.90.139.138:2222

184.153.132.82:443

185.135.120.81:443

24.228.132.224:2222

87.223.84.190:443

178.153.195.40:443

24.64.114.59:2222

77.126.81.208:443

75.99.125.235:2222

173.239.94.212:443

98.145.23.67:443

109.177.245.176:2222

72.200.109.104:443

12.172.173.82:993

82.11.242.219:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  
  WT-163WP.iso
- Size
  
  101.2MB
- MD5
  
  b650be9066248fd19bf55295a3dd91c1
- SHA1
  
  08dbe772979f2cf9b70637ecb4fbed0a29517b4a
- SHA256
  
  ad914a64e27ceb65f105dda2b9333507503acf7b5dfa24dcaf0eebed70e10c9b
- SHA512
  
  cd2dbb0d4addb80ff59126febd145b6a127378a6eadb18bdc3bffe8eab54b2db71352920c12be1882df88aa2eb8bd5b1d3b38124a4d607fabfd4194f380c3aaf
- SSDEEP
  
  24576:xFolOZ7iwCywfHH3vwLwZ0RV9Z0OEdMddz52kqAaBJP8fnLJ518VCqoI2ytH2:xFolOZ7iwCywfHH3vwLwDuDHAH2
Score

10^/10

qakbot obama224 1669794048 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1