General

  • Target

    icule40_orig.dll

  • Size

    332KB

  • Sample

    230503-ta886ahb4v

  • MD5

    401e607ca4648c0872a7f70baeadc7a3

  • SHA1

    44bb4c18341acac6f8ca05bb1ea6775f71efcb32

  • SHA256

    03ccfe67f7596c9babc3dba852733dcdacc9e20dcabcc636c74bd194cc18ba3b

  • SHA512

    da5be245b7e1e4eb7b9f1a370b281f563301e480dbee9214afd4ffb1ce229514a4598568eae152cfd839072c5b2ef98cf3f2f917ac43325a8692ac7195f43f24

  • SSDEEP

    6144:zGttsygB2RWc0sVkck6A4s9FGMReiD4DmELZ7e+piYE60W9OCdD:ittsygB2RWc0sVHk6AbDGSPYBpiN43d

Malware Config

Extracted

Family

qakbot

Version

404.1035

Botnet

BB26

Campaign

1683108322

C2

69.133.162.35:443

92.186.69.229:2222

92.1.170.110:995

93.150.183.229:2222

184.176.35.223:2222

75.143.236.149:443

14.192.241.76:995

151.65.214.218:443

201.244.108.183:995

92.188.241.102:443

103.111.70.66:443

86.171.131.244:995

12.172.173.82:22

96.56.197.26:2083

86.250.12.86:2222

47.21.51.138:443

27.99.32.26:2222

70.28.50.223:2083

108.190.115.159:443

151.213.66.34:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      icule40_orig.dll

    • Size

      332KB

    • MD5

      401e607ca4648c0872a7f70baeadc7a3

    • SHA1

      44bb4c18341acac6f8ca05bb1ea6775f71efcb32

    • SHA256

      03ccfe67f7596c9babc3dba852733dcdacc9e20dcabcc636c74bd194cc18ba3b

    • SHA512

      da5be245b7e1e4eb7b9f1a370b281f563301e480dbee9214afd4ffb1ce229514a4598568eae152cfd839072c5b2ef98cf3f2f917ac43325a8692ac7195f43f24

    • SSDEEP

      6144:zGttsygB2RWc0sVkck6A4s9FGMReiD4DmELZ7e+piYE60W9OCdD:ittsygB2RWc0sVHk6AbDGSPYBpiN43d

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks