General

  • Target

    cultivation.dat

  • Size

    608KB

  • Sample

    230602-tztj1acd53

  • MD5

    1158d283b86f29437b945dcbff15d271

  • SHA1

    d0ca7f3b857ba502282a82ae999f9cb16252221b

  • SHA256

    7e4d95082a010230aa024ac125e0adfffcfa914152219b2ef32b6893fe5ab9d7

  • SHA512

    6c69233ce82b1d9794cd995748b634060f2205ca16729f571cc997d35e4034ea6738d0169efec66248e3828a152356d66b27fd7dfe41a7e187ca63fd3b00d1e5

  • SSDEEP

    12288:zDxy+2MIBYYimb3oG11xfTUUk0uU7/GQ4vbnWj6:Pg+2MIBYkb4G11hTQ05bGM

Malware Config

Extracted

Family

qakbot

Version

404.1346

Botnet

BB30

Campaign

1685686808

C2

86.173.2.12:2222

92.9.45.20:2222

100.4.163.158:2222

213.64.33.92:2222

75.98.154.19:443

78.192.109.105:2222

88.126.94.4:50000

70.28.50.223:2083

92.154.17.149:2222

24.234.220.88:993

87.252.106.39:995

174.4.89.3:443

12.172.173.82:20

90.29.86.138:2222

70.160.67.203:443

223.166.13.95:995

184.181.75.148:443

95.45.50.93:2222

201.143.215.69:443

64.121.161.102:443

Targets

    • Target

      cultivation.dat

    • Size

      608KB

    • MD5

      1158d283b86f29437b945dcbff15d271

    • SHA1

      d0ca7f3b857ba502282a82ae999f9cb16252221b

    • SHA256

      7e4d95082a010230aa024ac125e0adfffcfa914152219b2ef32b6893fe5ab9d7

    • SHA512

      6c69233ce82b1d9794cd995748b634060f2205ca16729f571cc997d35e4034ea6738d0169efec66248e3828a152356d66b27fd7dfe41a7e187ca63fd3b00d1e5

    • SSDEEP

      12288:zDxy+2MIBYYimb3oG11xfTUUk0uU7/GQ4vbnWj6:Pg+2MIBYkb4G11hTQ05bGM

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks