General
-
Target
qbot.dat
-
Size
700KB
-
Sample
230131-wyp7ashe84
-
MD5
b0fcba1afd3f8db41e8992192530bbab
-
SHA1
c10623ade6372be11a2ac8566921ccf9d672237f
-
SHA256
9b3e176d132aebe39ee2205969f5065a21c315624a15e77fb5b1f13ff8abd6b6
-
SHA512
180ac8a742a30ffed9ec6f6a7d635bc091c9a7b217443bd85ea290a2728aa52c7cd60a2576a8d4a5c9286d2dac5510cf024fea9e8cd3b6ee25eb931c2c789d28
-
SSDEEP
12288:4qwFxm3G6H4RyuHbR1MxnuTV/iV1Sd/NzQNfy:lwFxm3G6H4IuHbR1MxnuTV/iV1QmNf
Static task
static1
Behavioral task
behavioral1
Sample
qbot.dll
Resource
win7-20220812-en
Malware Config
Extracted
qakbot
404.432
obama234
1675160190
85.241.180.94:443
12.172.173.82:50001
92.154.17.149:2222
103.42.86.246:995
12.172.173.82:990
91.254.132.23:443
121.121.100.207:995
74.92.243.113:50000
69.119.123.159:2222
156.217.247.173:995
50.68.204.71:995
76.170.252.153:995
92.8.190.175:2222
69.159.158.183:2222
172.248.42.122:443
12.172.173.82:2087
197.148.17.17:2078
75.143.236.149:443
69.133.162.35:443
50.68.204.71:443
125.20.112.94:443
206.188.201.143:2222
92.27.86.48:2222
71.46.234.171:443
85.59.61.52:2222
12.172.173.82:995
71.112.212.166:443
27.0.48.233:443
130.43.172.217:2222
98.175.176.254:995
200.109.207.186:2222
103.141.50.151:995
107.146.12.26:2222
136.232.184.134:995
181.118.183.2:443
136.244.25.165:443
197.204.184.160:443
183.87.163.165:443
5.163.163.51:995
102.156.154.112:443
87.223.87.126:443
91.165.188.74:50000
89.115.196.99:443
87.221.197.113:2222
89.79.229.50:443
84.108.200.161:443
123.3.240.16:995
161.142.104.187:995
173.76.49.61:443
47.21.51.138:995
175.139.129.94:2222
58.247.115.126:995
60.254.51.168:443
184.153.132.82:443
116.75.63.184:443
70.66.199.12:443
162.248.14.107:443
75.98.154.19:443
202.142.98.62:995
93.24.192.142:20
202.142.98.62:443
78.193.176.97:443
87.202.101.164:50000
82.121.195.187:2222
88.169.33.180:2222
89.129.109.27:2222
85.7.61.22:2222
86.130.9.182:2222
24.228.132.224:2222
86.96.72.139:2222
24.9.220.167:443
91.231.173.199:995
217.128.91.196:2222
102.156.174.28:443
213.67.255.57:2222
176.202.38.188:443
98.145.23.67:443
217.128.200.114:2222
70.77.116.233:443
67.10.175.47:2222
74.33.196.114:443
31.53.29.161:2222
12.172.173.82:20
90.104.22.28:2222
27.0.48.205:443
103.212.19.254:995
86.195.14.72:2222
119.82.122.226:443
92.154.45.81:2222
151.65.168.222:443
2.98.146.106:995
213.31.90.183:2222
47.61.70.188:2078
27.109.19.90:2078
173.178.151.233:443
198.2.51.242:993
86.194.156.14:2222
76.80.180.154:995
174.104.184.149:443
12.172.173.82:465
12.172.173.82:32101
171.97.42.67:443
73.36.196.11:443
71.31.101.183:443
81.229.117.95:2222
92.186.69.229:2222
24.71.120.191:443
83.202.26.241:2222
86.225.214.138:2222
31.120.202.209:443
109.159.119.95:2222
172.90.139.138:2222
92.207.132.174:2222
86.151.21.134:2222
66.191.69.18:995
70.160.80.210:443
84.35.26.14:995
86.207.227.152:2222
50.68.204.71:993
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
qbot.dat
-
Size
700KB
-
MD5
b0fcba1afd3f8db41e8992192530bbab
-
SHA1
c10623ade6372be11a2ac8566921ccf9d672237f
-
SHA256
9b3e176d132aebe39ee2205969f5065a21c315624a15e77fb5b1f13ff8abd6b6
-
SHA512
180ac8a742a30ffed9ec6f6a7d635bc091c9a7b217443bd85ea290a2728aa52c7cd60a2576a8d4a5c9286d2dac5510cf024fea9e8cd3b6ee25eb931c2c789d28
-
SSDEEP
12288:4qwFxm3G6H4RyuHbR1MxnuTV/iV1Sd/NzQNfy:lwFxm3G6H4IuHbR1MxnuTV/iV1QmNf
-
Loads dropped DLL
-