qakbot | 240f1bfee962f56cc11c784b6cd2d01ce408eaff828a02209174f16fe62942e1

General

Target

Agreement_138439_Mar4.zip
Size

1.5MB
Sample

230315-s3aevsea59
MD5

e0500dca79e9a372d1dbcbcadf898b73
SHA1

dafeded2db4dc008a8943c848954ea55a5cdd3c1
SHA256

240f1bfee962f56cc11c784b6cd2d01ce408eaff828a02209174f16fe62942e1
SHA512

2c811eefabafe2ec77c31227ad5824283a4e5932465757d89ca9b93a32aff4622128a87365ab4339a64fa1378e745dd7fe75a1e5740e41bd4abe7f6d1eb03877
SSDEEP

49152:wOA4ENIGDFC/yGxS8RFW/pwpsSNJucr5upB+Ajq:wi8IGAyCS8veSLuGaRjq

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

qakbot

Version

404.266

Botnet

obama242

Campaign

1678805546

C2

92.239.81.124:443

176.202.46.81:443

2.49.58.47:2222

86.225.214.138:2222

74.66.134.24:443

213.31.90.183:2222

12.172.173.82:50001

202.187.87.178:995

70.53.96.223:995

92.154.45.81:2222

186.64.67.54:443

81.158.112.20:2222

190.191.35.122:443

68.173.170.110:8443

12.172.173.82:993

98.145.23.67:443

12.172.173.82:22

37.186.55.60:2222

84.216.198.124:6881

73.161.176.218:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  
  Agreement_138439_Mar4.zip
- Size
  
  1.5MB
- MD5
  
  e0500dca79e9a372d1dbcbcadf898b73
- SHA1
  
  dafeded2db4dc008a8943c848954ea55a5cdd3c1
- SHA256
  
  240f1bfee962f56cc11c784b6cd2d01ce408eaff828a02209174f16fe62942e1
- SHA512
  
  2c811eefabafe2ec77c31227ad5824283a4e5932465757d89ca9b93a32aff4622128a87365ab4339a64fa1378e745dd7fe75a1e5740e41bd4abe7f6d1eb03877
- SSDEEP
  
  49152:wOA4ENIGDFC/yGxS8RFW/pwpsSNJucr5upB+Ajq:wi8IGAyCS8veSLuGaRjq
Score

1^/10
behavioral1
- Target
  
  Agreement_138439_Mar4.xll
- Size
  
  589KB
- MD5
  
  cf51d8bd44f4f7edd9705a167c111d93
- SHA1
  
  2215670091efc2b28c55b395cbdf46f73461a79f
- SHA256
  
  a0baff9c054043640cfc5075c8f4777cce697645cf3b143e1e3b0460521d0573
- SHA512
  
  3bd61a0531fcf984a0fef04cb33e1cadc8d216509501c2d1c81eb92d00a83b9a3d25aff228586a63a7aa65d281343a0cd3b9a797edc65ce65f79510b2df9e012
- SSDEEP
  
  6144:8cTaT6oGCNIamrNSYVntzpONtX7EmG2dOdQRG8l/dmMF7VndLmmmmmmm644tkw95:fbpSIm3OdQwgvpVndf42HXDiuJTMw4
Score

1^/10
behavioral2
- Target
  
  Agreement_138439a_Mar4.xll
- Size
  
  2.3MB
- MD5
  
  2c52dd0679d202b20f5252272853586f
- SHA1
  
  f35b6fe2bb2138a532ad8d9033a388eeb38f2559
- SHA256
  
  954df94e3c3fd61d04ae0f3e3afdcab2861e0c5810b44f9bcb6a486fd30f5c3f
- SHA512
  
  a2dc8dc26e29388ee4480140ac4131eb84fd6c1cc895baa3de22a7f14292fb18536e2cc5bb34d54bf1190f70b3bdec668099a73b051a262ed4782dd3b431a971
- SSDEEP
  
  49152:Wjryd3EfessB2KEAQ3PlAEIZ6QqrONloCt4nnM+DoRDPOjYvf9FB:aryd028KEl39AdZ/6y+9M7RDPZB
Score

10^/10

qakbot obama242 1678805546 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral3