qakbot | a99bf6b8702db64be753b1ae2d7b6f3ccbf6c01ec0d70a7fd98d1b5011b844d6

General

Target

Agreement_565062_Mar4.zip
Size

1.5MB
Sample

230317-bwanlsfg7w
MD5

0b265f5a0953658c55c7564c0ffe2ae3
SHA1

6fce07a967befbad61d09314137a825ff61e7f04
SHA256

a99bf6b8702db64be753b1ae2d7b6f3ccbf6c01ec0d70a7fd98d1b5011b844d6
SHA512

2bd2e95065bc17608c86d1bef71de861ab27e28a19582cc2fcfd30cbe45530e01b4204f3c9ad8f6476cb95a50c2c076322ee4d7208c3696872543529c3a77280
SSDEEP

49152:pgYH9s5svf+4PBRPSaNWTHMUAiK0yirbO8:pgE9XvflXarTsUAiNbO8

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.266

Botnet

obama242

Campaign

1678805546

C2

92.239.81.124:443

176.202.46.81:443

2.49.58.47:2222

86.225.214.138:2222

74.66.134.24:443

213.31.90.183:2222

12.172.173.82:50001

202.187.87.178:995

70.53.96.223:995

92.154.45.81:2222

186.64.67.54:443

81.158.112.20:2222

190.191.35.122:443

68.173.170.110:8443

12.172.173.82:993

98.145.23.67:443

12.172.173.82:22

37.186.55.60:2222

84.216.198.124:6881

73.161.176.218:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Extracted

Language

xlm4.0

Source

Targets

- Target
  
  Agreement_565062_Mar4.xll
- Size
  
  589KB
- MD5
  
  9d8fe6351591a67b5e930c5163e05532
- SHA1
  
  e830c54bf8632bdf2b5ea00813347d373a79c266
- SHA256
  
  3719a95c4dd2cf519808d6b7c4341c42a64eb0dc5c6a14b579dd084adb46a8fc
- SHA512
  
  38ccf29c02b9877014e2b9ca843a9f53b177336d0930ac59433de7f8e21ad3b2b2bc232df111d2155c2d179181a19417f95f3a14d85ea2c66b4bc1cc5b4bb798
- SSDEEP
  
  6144:8cTaT6oGCNIamrNSYVntFpONtX7EmG2dOdQRG8l/dmMF7VndLmmmmmmm644tkw95:fNpSIm3OdQwgvpVndf42HXDiuJTMw4
Score

10^/10

qakbot obama242 1678805546 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  Agreement_565062a_Mar4.xll
- Size
  
  2.3MB
- MD5
  
  9ae0533703855cd44bf13766c54e7b30
- SHA1
  
  ad12b0bdc614c24b87448b3f3eca853a9ec976fe
- SHA256
  
  50fa7ea5099ab599d306ecdfd637a2201971596f601372b675b3d0172a3d56aa
- SHA512
  
  10612182cebdf4968b988cde3580a1135281b1267c88fa5dc1acafe797027e12ffa2a4fcd143e0b1c49dfb7fe129e852bf1406d5fa11ca141f405705ad872e55
- SSDEEP
  
  49152:WjrTd3EfessB2KEAQ3PlAEIZ6QqrONloCt4nnM+DoRDPOjYvf9FB:arTd028KEl39AdZ/6y+9M7RDPZB
Score

10^/10

qakbot obama242 1678805546 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral3 behavioral4