qakbot | 15d37b513139b5a248ee4b91b311bf5f1bfd74e5d57ab8b33e3bab12137822dc

Sharing

Copy URL Twitter E-mail

General

Target
oOo.dll
Size 435KB
Sample230512-pljenada77
SHA256 15d37b513139b5a248ee4b91b311bf5f1bfd74e5d57ab8b33e3bab12137822dc
MD5 438d33ed4f70d5fde97fe60e6e62da82
SHA1 6ffc71cdfa83dfe6a4cd45c4cc30df181d618d4d
SHA512 ee1bcfe6ec3120f63420728fffeba528ee70ef48b2cf1bf4914e9498ace83a0f09257cddf80f6b4bbb0a9c185ec86e9b9838c7ae2bc6070f099fdcd1bc3e4955
SSDEEP 6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8F:9/Cw6Z4nilhFX8mCXDckOPeJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.1038

Botnet

BB27

Campaign

1683816541

68.68.170.218:443
142.189.121.178:2222
213.91.235.146:443
71.78.95.86:995
92.9.45.20:2222
81.229.117.95:2222
201.244.108.183:995
50.68.186.195:443
90.104.151.37:2222
92.188.241.102:443
198.2.51.242:993
12.172.173.82:20
72.222.73.150:443
31.190.225.7:443
70.54.65.197:2222
70.28.50.223:2083
172.115.17.50:443
70.112.206.5:443
122.184.143.86:443
47.32.78.150:443
92.239.81.124:443
47.199.241.39:443
67.177.41.245:443
72.134.124.16:443
12.172.173.82:995
99.230.89.236:2078
87.202.101.164:50000
193.253.53.157:2078
76.178.148.107:2222
41.186.88.38:443
147.219.4.194:443
47.34.30.133:443
68.14.195.55:995
98.37.25.99:443
188.28.72.118:443
119.82.121.87:443
67.10.9.125:995
184.182.66.109:443
78.192.109.105:2222
74.92.243.115:50000
85.61.165.153:2222
97.93.192.2:2083
62.35.100.38:443
98.187.21.2:443
81.156.1.223:443
84.108.200.161:443
190.141.193.170:443
96.56.197.26:2222
86.196.12.21:2222
72.205.104.134:443
197.148.17.17:2078
70.53.193.201:2222
47.205.25.170:443
207.107.118.2:443
12.172.173.82:465
75.143.236.149:443
72.188.103.221:443
14.192.241.76:995
84.35.26.14:995
86.140.160.231:2222
70.28.50.223:1194
108.190.115.159:443
24.69.137.232:2222
47.21.51.138:443
173.206.84.174:443
79.47.207.6:443
76.16.49.134:443
64.121.161.102:443
98.19.224.125:995
184.176.35.223:2222
67.61.61.31:443
80.12.88.148:2222
75.109.111.89:443
12.20.0.235:2222
88.126.94.4:50000
88.171.156.150:50000
75.98.154.19:443
70.51.136.238:2222
96.87.28.170:2222
73.22.121.210:443
113.11.92.30:443
86.130.9.208:2222
27.109.19.90:2078
70.28.50.223:32100
89.129.109.27:2222
12.172.173.82:21
70.28.50.223:2087
200.93.26.107:2222
50.68.204.71:993
12.172.173.82:32101
173.88.135.179:443
70.28.50.223:3389
86.99.48.130:2222
67.219.197.94:443
76.64.99.251:2222
86.250.12.86:2222
136.35.241.159:443
69.157.243.204:2222
216.36.153.248:443
173.176.4.133:443
92.154.17.149:2222
178.152.124.169:443
83.114.60.6:2222
24.206.27.39:443
184.153.132.82:443
68.109.240.71:443
208.180.17.32:2222
109.159.119.82:2222
186.52.239.187:995
190.28.74.251:443
86.244.255.82:2222
12.172.173.82:993
50.68.204.71:995
50.68.204.71:443
96.56.197.26:2083
37.14.229.220:2222
162.248.14.107:443
186.64.67.41:443
70.28.50.223:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  oOo.dll
- Size 435KB
- SHA256 15d37b513139b5a248ee4b91b311bf5f1bfd74e5d57ab8b33e3bab12137822dc
- MD5 438d33ed4f70d5fde97fe60e6e62da82
- SHA1 6ffc71cdfa83dfe6a4cd45c4cc30df181d618d4d
- SHA512 ee1bcfe6ec3120f63420728fffeba528ee70ef48b2cf1bf4914e9498ace83a0f09257cddf80f6b4bbb0a9c185ec86e9b9838c7ae2bc6070f099fdcd1bc3e4955
- SSDEEP 6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8F:9/Cw6Z4nilhFX8mCXDckOPeJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot bb27 1683816541 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2