qakbot | 4fb872cb20c2e7878a7569d6595d9014d00941f32a873a32872455d14ac01626

General

Target

Agreement_149596_Mar4.zip
Size

1.5MB
Sample

230314-yjq66abd71
MD5

b9de7fb7096221779de4edb9d7063674
SHA1

f8d8be30ae39d5dca8cb7bd3ae20de776630a632
SHA256

4fb872cb20c2e7878a7569d6595d9014d00941f32a873a32872455d14ac01626
SHA512

89e5050a5b3fd169b29ac6830d10760ad1962269b211410324c1e0808fc937a03fcc4200a86fde7f8c55b200c9eb15b7787b8e0164e565970b4bf98bdf5e048a
SSDEEP

49152:Gne4htjKuRbjWIBX8s1CPSaNWTHMUAiK0yBr0tvIN:GLt+AzUarTsUAiQ0tvIN

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

qakbot

Version

404.266

Botnet

obama242

Campaign

1678805546

C2

92.239.81.124:443

176.202.46.81:443

2.49.58.47:2222

86.225.214.138:2222

74.66.134.24:443

213.31.90.183:2222

12.172.173.82:50001

202.187.87.178:995

70.53.96.223:995

92.154.45.81:2222

186.64.67.54:443

81.158.112.20:2222

190.191.35.122:443

68.173.170.110:8443

12.172.173.82:993

98.145.23.67:443

12.172.173.82:22

37.186.55.60:2222

84.216.198.124:6881

73.161.176.218:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  
  Agreement_149596_Mar4.zip
- Size
  
  1.5MB
- MD5
  
  b9de7fb7096221779de4edb9d7063674
- SHA1
  
  f8d8be30ae39d5dca8cb7bd3ae20de776630a632
- SHA256
  
  4fb872cb20c2e7878a7569d6595d9014d00941f32a873a32872455d14ac01626
- SHA512
  
  89e5050a5b3fd169b29ac6830d10760ad1962269b211410324c1e0808fc937a03fcc4200a86fde7f8c55b200c9eb15b7787b8e0164e565970b4bf98bdf5e048a
- SSDEEP
  
  49152:Gne4htjKuRbjWIBX8s1CPSaNWTHMUAiK0yBr0tvIN:GLt+AzUarTsUAiQ0tvIN
Score

1^/10
behavioral1
- Target
  
  Agreement_149596_Mar4.xll
- Size
  
  589KB
- MD5
  
  78a955c3b47a84998496846e0c2b5e02
- SHA1
  
  50fb2484f1ea12ce984b23cd0ae62f11bcaf1ce4
- SHA256
  
  4cffeba29508cab8441f35dd6b09441f63f80214e117de6d07eaaa27fa841f8b
- SHA512
  
  150610b18d557b1799b1f2042f21cf2ca77160383527ee67092ca4783de921827440ab5e886e59172c9ad69432c8abe392a2198a079375098db82aa09e6788a9
- SSDEEP
  
  6144:8cTaT6oGCNIamrNSYVntapONtX7EmG2dOdQRG8l/dmMF7VndLmmmmmmm644tkw95:fSpSIm3OdQwgvpVndf42HXDiuJTMw4
Score

1^/10
behavioral2
- Target
  
  Agreement_149596a_Mar4.xll
- Size
  
  2.3MB
- MD5
  
  0970225251d70ef7ad16012784a78bbc
- SHA1
  
  3b3fd025639211b3a5dbf10a3dfd4aadbe7e3327
- SHA256
  
  3e18f7f569a95929ccc0fea8fb5c199d42bb764d844ee07e6ca00043b5ae2b6c
- SHA512
  
  734298a1e7b2f76773867c486979c245937d441d76f882200dc905e17b1121f8e5119e8a1f004659f83c68574597db835cfa39bb6f56413cb316a5bcce94cf1d
- SSDEEP
  
  49152:WjrGd3EfessB2KEAQ3PlAEIZ6QqrONloCt4nnM+DoRDPOjYvf9FB:arGd028KEl39AdZ/6y+9M7RDPZB
Score

10^/10

qakbot obama242 1678805546 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral3