qakbot | 3e15a3bf700eb4cea2bd0d49ef100f295520972544a224d51501906d86ef7714

Sharing

Copy URL Twitter E-mail

General

Target
unknown_PID554_hiddenmodule_8F0000_x86.dll
Size 144KB
Sample230213-sp9msseb22
SHA256 3e15a3bf700eb4cea2bd0d49ef100f295520972544a224d51501906d86ef7714
MD5 1f672b4e8257e3dfd3d7eee04f1efac9
SHA1 9a2cbf2c742307eeea28c81cc1bbd713a882b4f1
SHA512 28d23c8db00efadb63c27c54819ba562b6b802d518970378c89eec4719132c498b4a65d8e33215f0951cbc15ceb8a668e38d8f82aede0f905f5a6dc2776d8993
SSDEEP 3072:G6MvCeiR77JQyCEz62xG3A9JCXF0LTBfvy/1:LR77J1ZzhGw9J6F0LTBny/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.432

Botnet

BB12

Campaign

1675417198

12.172.173.82:995
12.172.173.82:2087
50.68.204.71:443
84.215.202.22:443
98.175.176.254:995
184.155.91.69:443
50.68.186.195:443
183.87.163.165:443
172.248.42.122:443
93.156.100.20:443
102.156.32.143:443
50.60.157.175:995
75.143.236.149:443
69.133.162.35:443
105.184.159.165:995
130.43.172.217:2222
82.36.36.76:443
73.223.248.31:443
202.142.98.62:443
73.161.176.218:443
109.149.147.148:2222
190.199.188.186:2222
67.10.175.47:2222
176.142.207.63:443
208.187.122.74:443
87.221.197.113:2222
2.14.144.105:2222
31.53.29.161:2222
27.109.19.90:2078
213.31.90.183:2222
78.130.215.67:443
82.127.204.82:2222
91.231.173.199:995
71.52.53.166:443
161.142.104.187:995
86.207.227.152:2222
213.67.255.57:2222
82.121.195.187:2222
180.158.187.35:995
89.129.109.27:2222
37.14.229.220:2222
12.172.173.82:50001
83.7.52.16:443
47.61.70.188:2078
173.76.49.61:443
24.64.112.40:2222
47.21.51.138:995
58.247.115.126:995
175.139.129.94:2222
116.75.63.125:443
116.72.250.18:443
86.96.72.139:2222
66.191.69.18:995
102.159.99.116:443
92.27.86.48:2222
83.213.192.136:443
83.202.26.241:2222
103.141.50.151:995
197.204.236.174:443
74.33.196.114:443
24.64.112.40:2078
12.172.173.82:20
84.219.213.130:6881
90.104.22.28:2222
27.0.48.233:443
119.82.122.226:443
59.28.84.65:443
136.232.184.134:995
70.66.199.12:443
125.99.69.178:443
162.248.14.107:443
75.98.154.19:443
87.243.146.59:443
88.126.94.4:50000
92.154.45.81:2222
197.148.17.17:2078
64.237.207.9:443
92.186.69.229:2222
73.165.119.20:443
76.64.202.88:2222
98.145.23.67:443
91.68.227.219:443
70.77.116.233:443
79.9.64.37:995
174.104.184.149:443
24.64.112.40:3389
81.151.102.224:443
47.34.30.133:443
86.250.12.217:2222
50.68.204.71:993
156.217.208.137:995
181.118.206.65:995
103.212.19.254:995
83.114.60.6:2222
90.23.19.86:2222
66.131.25.6:443
12.172.173.82:465
86.195.14.72:2222
184.153.132.82:443
91.170.115.68:32100
72.80.7.6:995
71.31.101.183:443
198.2.51.242:993
125.20.112.94:443
92.11.194.53:995
12.172.173.82:32101
31.120.202.209:443
173.18.126.3:443
76.80.180.154:995
24.71.120.191:443
27.0.48.205:443
81.229.117.95:2222
103.252.7.228:443
190.191.35.122:443
87.223.87.126:443
84.35.26.14:995
73.36.196.11:443
171.97.42.67:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  unknown_PID554_hiddenmodule_8F0000_x86.dll
- Size 144KB
- SHA256 3e15a3bf700eb4cea2bd0d49ef100f295520972544a224d51501906d86ef7714
- MD5 1f672b4e8257e3dfd3d7eee04f1efac9
- SHA1 9a2cbf2c742307eeea28c81cc1bbd713a882b4f1
- SHA512 28d23c8db00efadb63c27c54819ba562b6b802d518970378c89eec4719132c498b4a65d8e33215f0951cbc15ceb8a668e38d8f82aede0f905f5a6dc2776d8993
- SSDEEP 3072:G6MvCeiR77JQyCEz62xG3A9JCXF0LTBfvy/1:LR77J1ZzhGw9J6F0LTBny/
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Loads dropped DLL

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2