qakbot | 9e73fbc799272df3a85b6ef77894b061d91e5214a67ed2f1dd8b91f981b57ac5

Sharing

Copy URL Twitter E-mail

General

Target
9261229524.zip
Size 1.3MB
Sample230223-jbj1jsfa99
SHA256 9e73fbc799272df3a85b6ef77894b061d91e5214a67ed2f1dd8b91f981b57ac5
MD5 de77dbe6cc29fa6d6b05f81cdfa43a58
SHA1 99687e88405065e4fb92c062057918c2b91decd2
SHA512 af71f77efcaf7aec4bca6abd873e26257041f322deac8deb83c4520845bc85e7dbe1f61b4d03b171f238391607c3244b27be30c83926eaded2143f33237537d6
SSDEEP 24576:QSJHxGjVTp9h43u6DbJU+XcF+HKjVWQM8mV3wQjA3vECZ9EfFOEx6W:bJMjV9/wrDb2+0S2cQM93wQjA3DIT6W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.9

Botnet

BB16

Campaign

1677046917

47.21.51.138:443
72.80.7.6:50003
82.127.204.82:2222
49.175.72.56:443
201.244.108.183:995
122.184.143.82:443
102.156.253.86:443
74.58.71.237:443
47.21.51.138:995
77.86.98.236:443
71.31.101.183:443
136.232.184.134:995
86.225.214.138:2222
95.242.101.251:995
109.11.175.42:2222
90.78.138.217:2222
184.176.35.223:2222
35.143.97.145:995
202.186.177.88:443
114.79.180.14:995
86.150.47.219:443
183.87.163.165:443
50.68.186.195:443
190.75.95.164:2222
98.145.23.67:443
67.10.175.47:2222
71.212.147.224:2222
88.126.94.4:50000
103.140.174.19:2222
103.231.216.238:443
78.84.123.237:995
180.151.108.14:443
80.47.57.131:2222
198.2.51.242:993
50.68.204.71:995
205.164.227.222:443
147.219.4.194:443
77.124.6.149:443
49.245.82.178:2222
46.10.198.107:443
76.80.180.154:995
12.172.173.82:32101
68.150.18.161:443
68.173.170.110:8443
24.9.220.167:443
12.172.173.82:2087
50.68.204.71:993
107.146.12.26:2222
81.229.117.95:2222
27.0.48.233:443
69.133.162.35:443
59.28.84.65:443
76.170.252.153:995
89.32.159.192:995
202.142.98.62:995
73.78.215.104:443
181.164.217.211:443
92.97.203.51:2222
116.74.164.26:443
103.141.50.102:995
149.74.159.67:2222
116.72.250.18:443
125.99.69.178:443
202.142.98.62:443
67.61.71.201:443
103.123.223.168:443
80.13.205.69:2222
80.0.74.165:443
86.99.54.39:2222
213.67.255.57:2222
176.142.207.63:443
50.67.17.92:443
217.165.1.53:2222
70.64.77.115:443
2.50.47.74:443
66.191.69.18:995
75.143.236.149:443
197.92.136.122:443
108.190.203.42:995
50.68.204.71:443
12.172.173.82:995
70.77.116.233:443
162.248.14.107:443
75.98.154.19:443
58.247.115.126:995
184.68.116.146:61202
41.99.50.76:443
184.68.116.146:3389
72.203.216.98:2222
103.252.7.231:443
12.172.173.82:50001
70.160.80.210:443
12.172.173.82:465
12.172.173.82:21
47.34.30.133:443
202.187.232.161:995
98.147.155.235:443
124.122.56.144:443
75.141.227.169:443
103.144.201.53:2078
172.248.42.122:443
12.172.173.82:990
24.239.69.244:443
173.18.126.3:443
73.165.119.20:443
90.104.22.28:2222
14.192.241.76:995
74.33.196.114:443
74.93.148.97:995
86.202.48.142:2222
174.104.184.149:443
12.172.173.82:20
109.151.144.37:443
104.35.24.154:443
114.143.176.234:443
84.35.26.14:995
45.50.233.214:443
64.237.185.60:443
73.161.176.218:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  RR.lnk
- Size 1KB
- SHA256 0de89af6fa556b786c8de96fb3cfe96307ce8d8a14cef1fb6ca2f0d9e56be9b0
- MD5 40c516687897e29cc967eaafd7355a64
- SHA1 a68ca9733941ab3501a9c9baef7ec58587e79a45
- SHA512 c23f88250532be801990b104d3e32ea8d3e4a55a20478599cbad9103d110c014156cd6b71fe262bea14d968fa71cc1b8ae7cf334a0df27bb887392ef31dbfa52
- MD5 SHA1 SHA512
Score

10^/10

qakbot bb16 1677046917 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2
- Target
  vibrations/circlets.exe
- Size 1.6MB
- SHA256 22d1471ed17c681aa5580c59712005e1c70ef9c306cbcad245a64f7dfae47847
- MD5 018796d4670ac12865be2f00382bbc8e
- SHA1 8564027153dca487eca613345ab3b2de0add4f26
- SHA512 4edac00e0d19b439c300328bf4f7abc98cadfce0d7f4283f1c6278bec24d0ed7c2e51090a2e584a7a2a2e645e396a890d9589fe3f660fa73fc238a09d827bc7b
- SSDEEP 24576:qN2PGK9rDuNMZD22lHNFVntTX25fHSMv0UskeuzQU2z6IdcL6UCUK:qN2P39PuNYvlHTX2EMuZuzJ2z6nzK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  vibrations/floodlight.cmd
- Size 239B
- SHA256 86117f16adb7a919d320c5a105099fbdb64a18274ba78bb33d5b072e6fa0fbfc
- MD5 4f4d7d05a2e6eac735471a6e31e435fc
- SHA1 998870f26d8ab35561ebdfcd90a6f2dd0a646b43
- SHA512 1f31f1bd645546295c545559d2fba033c039c9e2ca3a9bdb2b5545192cfa2c3aa3a2ceb9a3982652cf0f48bd801a72642753519fc02d6417f03dc4bd1f330f17
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Checks computer location settings

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6