qakbot | c08675ecfcb06a2b57b946051d3a63693e4a1de9a33cc98f0cb8a50205906edf

Resubmissions

27/12/2022, 14:30

221227-rt6w2aab9s10

27/12/2022, 14:29

221227-rt3jlsfa4310

27/12/2022, 12:27

221227-pmp9laeh3710

27/12/2022, 12:24

221227-pk183saa9s10

Sharing

Copy URL Twitter E-mail

General

Target
user.dat
Size 2.0MB
Sample221227-rt6w2aab9s
SHA256 c08675ecfcb06a2b57b946051d3a63693e4a1de9a33cc98f0cb8a50205906edf
MD5 37bf163c9a37e27cdbb8c5db31457063
SHA1 6e5a4df996ffefd5ef01ff8a13913ec09ba404da
SHA512 131dfdc3f1e648718887648690f0631bd6d77e137d2562aa47d5abec058dcde93f2c3f12bc82ca487d3d60285c126707eae414738f04e20325c599fab3ae072b
SSDEEP 49152:TDG9pmVnnyKKdmwLxSMKmc2qgI9Mprlcuhz6:/VVnnP8XLQL2q1YSu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

BB11

Campaign

1671561386

184.68.116.146:3389
92.189.214.236:2222
73.29.92.128:443
92.239.81.124:443
47.203.227.114:443
199.83.165.233:443
12.172.173.82:995
12.172.173.82:50001
136.244.25.165:443
37.15.128.31:2222
91.96.249.3:443
92.27.86.48:2222
75.156.125.215:995
93.147.134.85:443
86.176.246.195:2222
89.129.109.27:2222
70.55.120.16:2222
50.67.17.92:443
78.92.133.215:443
190.100.149.122:995
86.183.251.169:2222
184.68.116.146:2222
217.43.16.149:443
208.180.17.32:2222
75.143.236.149:443
70.64.77.115:443
76.184.95.190:993
73.161.176.218:443
84.35.26.14:995
67.235.138.14:443
206.166.209.170:2222
108.6.249.139:443
70.51.136.204:2222
67.253.226.137:995
201.137.206.40:443
176.44.121.220:995
31.48.67.240:443
80.103.77.44:2222
86.160.253.56:443
184.68.116.146:2078
76.80.180.154:995
181.118.183.50:443
173.178.151.233:443
72.80.7.6:995
109.220.196.24:2222
47.34.30.133:443
76.170.252.153:995
12.172.173.82:21
216.36.153.248:443
70.77.116.233:443
47.41.154.250:443
108.162.6.34:443
50.68.204.71:443
24.69.84.237:443
87.65.160.87:995
73.36.196.11:443
76.68.151.148:2222
89.203.252.238:443
81.131.210.167:443
96.255.66.51:995
12.172.173.82:465
95.23.15.84:2222
67.61.71.201:443
66.191.69.18:995
51.211.219.211:443
79.13.202.140:443
77.86.98.236:443
70.115.104.126:995
152.170.17.136:443
70.120.228.205:443
178.153.5.54:443
12.172.173.82:20
91.254.132.23:443
72.88.245.71:443
45.230.169.132:995
142.118.49.193:2222
65.95.85.172:2222
136.35.241.159:443
69.159.156.133:2222
92.8.187.85:2222
69.133.162.35:443
184.68.116.146:50010
86.130.9.250:2222
149.74.159.67:2222
176.133.4.230:995
46.10.198.106:443
2.14.96.234:2222
78.101.91.215:2222
92.154.45.81:2222
79.77.142.22:2222
12.172.173.82:22
12.172.173.82:32101
90.66.229.185:2222
86.225.214.138:2222
173.18.126.3:443
174.104.184.149:443
90.89.95.158:2222
162.248.14.107:443
190.249.241.149:443
78.18.42.55:443
184.68.116.146:61202
64.123.103.123:443
12.172.173.82:990
38.166.221.92:2087
184.176.154.83:995
92.207.132.174:2222
75.98.154.19:443
142.161.27.232:2222
84.113.121.103:443
90.104.22.28:2222
75.84.234.68:443
198.2.51.242:993
86.139.213.115:443
50.68.204.71:993
201.210.114.115:993
71.31.101.183:443
74.33.196.114:443
87.252.106.197:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  user.dat
- Size 2.0MB
- SHA256 c08675ecfcb06a2b57b946051d3a63693e4a1de9a33cc98f0cb8a50205906edf
- MD5 37bf163c9a37e27cdbb8c5db31457063
- SHA1 6e5a4df996ffefd5ef01ff8a13913ec09ba404da
- SHA512 131dfdc3f1e648718887648690f0631bd6d77e137d2562aa47d5abec058dcde93f2c3f12bc82ca487d3d60285c126707eae414738f04e20325c599fab3ae072b
- SSDEEP 49152:TDG9pmVnnyKKdmwLxSMKmc2qgI9Mprlcuhz6:/VVnnP8XLQL2q1YSu
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot bb11 1671561386 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2