qakbot | f63086c99c27b5fd80589d07388f0a9e0707f5403bcba1158d29db6dc0610dc0

Sharing

Copy URL Twitter E-mail

General

Target
SCANS_ED7476.rar
Size 358KB
Sample221210-prj85sac51
SHA256 f63086c99c27b5fd80589d07388f0a9e0707f5403bcba1158d29db6dc0610dc0
MD5 ec72d5fad42825e90298005396625dd4
SHA1 f484654c6f13d0d1c33b021f09b0212c64ff268d
SHA512 51c0b82f461b191acad34c06cdcb12e4cac6d86f8ddcc2454a18ba37bfd64eefc09f23c40053bbdd57670307167cec02c8a1350851d0b9e5e9ca1439441ac234
SSDEEP 6144:F8QUOp+RSli6ojpiTwGp9zkzfMAjMpOdTaIaW7ya09m3AT2c0hckVUL9bnw2tar7:OQUg+cli6sswzfMAjMgUIaWmakm3ATF+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

Campaign

1670585125

172.90.139.138:2222
90.116.219.167:2222
173.239.94.212:443
91.169.12.198:32100
74.66.134.24:443
66.191.69.18:995
182.75.189.42:995
78.69.251.252:2222
98.145.23.67:443
103.71.21.107:443
197.94.219.133:443
91.68.227.219:443
12.172.173.82:993
86.176.83.127:2222
64.121.161.102:443
41.98.21.114:443
92.154.17.149:2222
151.65.67.211:443
89.129.109.27:2222
76.11.14.249:443
69.119.123.159:2222
70.66.199.12:443
12.172.173.82:990
183.82.100.110:2222
83.114.60.6:2222
92.189.214.236:2222
70.115.104.126:995
190.18.236.175:443
121.122.99.223:995
72.53.103.56:443
91.165.188.74:50000
12.172.173.82:995
156.220.229.249:993
86.96.75.237:2222
85.152.152.46:443
181.118.183.44:443
76.80.180.154:995
81.248.77.37:2222
90.66.229.185:2222
86.130.9.250:2222
172.117.139.142:995
12.172.173.82:465
75.143.236.149:443
81.229.117.95:2222
81.111.108.123:443
50.68.204.71:995
124.122.55.68:443
139.5.239.14:443
37.56.111.49:995
46.10.198.106:443
85.61.165.153:2222
90.104.22.28:2222
88.126.94.4:50000
90.89.95.158:2222
83.213.201.104:993
73.223.248.31:443
47.41.154.250:443
2.99.47.198:2222
190.199.169.127:993
83.92.85.93:443
184.68.116.146:2222
73.161.176.218:443
150.107.231.59:2222
98.178.242.28:443
213.67.255.57:2222
174.104.184.149:443
108.6.249.139:443
84.35.26.14:995
149.126.159.106:443
184.68.116.146:3389
37.14.229.220:2222
24.206.27.39:443
199.83.165.233:443
84.215.202.22:443
71.247.10.63:995
50.68.204.71:443
86.169.19.140:2222
76.20.42.45:443
70.55.120.16:2222
69.133.162.35:443
12.172.173.82:21
72.200.109.104:443
50.68.204.71:993
2.83.12.243:443
184.176.154.83:995
176.177.136.35:443
92.207.132.174:2222
174.77.209.5:443
142.161.27.232:2222
86.159.48.25:2222
100.6.8.7:443
184.153.132.82:443
27.109.19.90:2078
94.105.123.53:443
198.2.51.242:993
70.120.228.205:443
75.158.15.211:443
181.164.194.223:443
184.68.116.146:61202
184.68.116.146:2078
86.225.214.138:2222
78.213.14.206:443
176.142.207.63:443
73.36.196.11:443
197.26.142.159:443
176.151.15.101:443
87.65.160.87:995
92.24.200.226:995
87.221.197.110:2222
77.86.98.236:443
162.248.14.107:443
84.113.121.103:443
137.186.193.226:3389
92.8.190.211:2222
201.208.139.250:2222
12.172.173.82:22
75.98.154.19:443
24.142.218.202:443
70.77.116.233:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  SCANS_ED7476.lnk
- Size 1KB
- SHA256 ad1dbb7757e37cce274e096f0970212e858d2e338772f276d2479b18d7bc52f8
- MD5 ec2ac1e8da4b9930358601c25518570a
- SHA1 69ae15e18ae0d277bcf740b59e138dc1c7ae6b73
- SHA512 9f52e7d36d3a2e4de175fda4575758ce9da8f89e781161bae4a2e364bacb5b549744fa25f9bf0282adf6c323523ee352284a3bc7af3bea890fcdea812e086aa5
- MD5 SHA1 SHA512
Score

10^/10

qakbot azd 1670585125 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  YouContract/RecentInformation.cmd
- Size 9KB
- SHA256 131ef57ff1b1c67d51391ad238a9fe9507032d8e82a315a042fccbfc06b95b2e
- MD5 c415428943d6ae9df3ddf926be29f31e
- SHA1 c0c8057c59a80112d4e72a99c052e28bb017422a
- SHA512 5c1141c2c79aa93718f8555603067ce317fb64bae94e916310a062e78aae142ac549a54ef8816536687a797121d233998a0dffdf36201625107c6ea4cc3f9d8e
- SSDEEP 192:Crn0dKaEYw6Nndn8FkSUzUeHYNWqTJn7ami2u0mwoIWfF4J6e1:Crn0dKajNdn8ySUzUTn7ni2u0mwFIqJL
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot azd 1670585125 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral3 behavioral4
- Target
  YouContract/YouNewRules.get
- Size 683KB
- SHA256 c2818a0dde04b70ce0f01342df88b2d01c2ab0fced4e94fdc1254bf505325bf6
- MD5 3c359f052ab36b9a2dc3c295065a18a0
- SHA1 eaaa009b3a42ea965dd55d525e38ce40d30e4069
- SHA512 c440d7a35870cb17c0a60d99ec9b9dad0fc226162bbd21c11642d4f66f4c77a44882b5b89fe46628031fdedccdc0f253fcfc0479e934664827dd0745a6152db6
- SSDEEP 12288:2BZFJonOQg2uym3Fkz1ee5MJ4XpJ5g7x4BdqEz6QQBGPpBi1fn:6f8OQg2uysCV3ZJ4y+Y0BEnwn
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot azd 1670585125 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral5 behavioral6

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Checks computer location settings

Qakbot/Qbot

Qakbot/Qbot

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6