qakbot | 0de798f0071896942577685db015ea1c4888e80130936bb87fdcfe36404f1cfd

Sharing

Copy URL Twitter E-mail

General

Target
quad-damage.tmp
Size 1.8MB
Sample230615-s3a2dsad44
SHA256 0de798f0071896942577685db015ea1c4888e80130936bb87fdcfe36404f1cfd
MD5 b0888905062d1fb8a264fe39ec53a6bd
SHA1 efe90ac0ceb251530785c3ab10053876644834b1
SHA512 179ec56c04c3c565d7e5b473b9ffa9d8fac3714c8a78c4df0707b180185e4c4129823f88a92538a5ea24fb275d47f7b88f555bb6a9a76a5deb519e07bad27625
SSDEEP 49152:SDXMFMJYpvi0T5Tc+Ay76cGwMVQrBZzUBeKWprRff3P1+EZ2Qjmuf1yoX6:SDXMFMJoP7gK5dKyPp6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

BB32

Campaign

1686813265

113.11.92.30:443
86.160.253.50:443
151.62.174.154:443
77.86.98.236:443
86.195.14.72:2222
12.172.173.82:2087
67.87.119.216:2078
84.213.236.225:995
70.28.50.223:2078
86.164.33.69:995
58.162.223.233:443
98.4.43.111:443
203.219.204.180:443
79.168.224.165:2222
80.12.88.148:2222
1.221.179.74:443
201.244.108.183:995
2.36.64.159:2078
72.205.104.134:443
74.12.147.242:2083
37.186.59.83:2222
65.30.139.145:995
82.125.44.236:2222
172.115.17.50:443
110.159.115.244:443
82.127.153.75:2222
64.121.161.102:443
187.199.244.117:32103
50.68.186.195:443
96.255.66.51:995
223.166.13.95:995
80.6.50.34:443
116.75.58.53:443
84.215.202.8:443
183.87.163.165:443
142.181.206.222:2222
165.120.244.223:2222
175.156.65.126:2222
109.149.147.195:2222
96.87.28.170:2222
12.172.173.82:995
92.154.17.149:2222
75.109.111.89:443
70.160.67.203:443
88.126.94.4:50000
70.28.50.223:3389
70.28.50.223:32100
24.234.220.88:995
66.241.183.99:443
74.12.147.242:2222
23.234.237.3:443
47.205.25.170:443
12.172.173.82:993
174.4.89.3:443
39.40.59.71:2222
84.35.26.14:995
197.204.215.75:443
135.19.158.248:2222
142.154.32.124:443
67.87.119.216:2083
72.134.124.16:443
24.234.220.88:993
181.230.169.180:443
94.206.4.66:2222
92.9.45.20:2222
86.196.12.21:2222
180.151.13.23:2078
91.169.12.198:32100
12.172.173.82:20
46.246.216.208:995
100.4.182.142:2222
76.16.49.134:443
92.186.69.229:2222
73.29.92.128:443
95.45.50.93:2222
84.216.198.201:6881
60.189.156.185:993
213.91.235.146:443
213.64.33.92:2222
189.223.184.79:443
47.34.30.133:443
70.28.50.223:2087
12.172.173.82:465
188.28.19.84:443
67.219.197.94:443
12.172.173.82:50001
161.142.100.114:995
102.158.231.164:443
217.165.255.105:443
71.12.26.62:443
90.7.72.46:2222
27.0.48.233:443
189.223.76.48:443
41.99.230.1:443
94.204.247.243:443
103.140.174.20:2222
199.27.66.213:443
178.175.187.254:443
223.122.118.123:443
103.141.50.43:995
176.142.207.63:443
12.172.173.82:21
45.2.61.134:3389
162.248.14.107:443
98.147.155.235:443
47.21.51.138:443
77.126.99.230:443
12.172.173.82:32101
24.234.220.88:465
70.28.50.223:1194
78.159.145.7:995
85.61.165.153:2222
38.2.18.164:443
121.121.100.202:995
103.139.242.75:443
104.35.24.154:443
200.112.67.75:32100
81.229.117.95:2222
23.91.184.29:80

Targets

- Target
  quad-damage.tmp
- Size 1.8MB
- SHA256 0de798f0071896942577685db015ea1c4888e80130936bb87fdcfe36404f1cfd
- MD5 b0888905062d1fb8a264fe39ec53a6bd
- SHA1 efe90ac0ceb251530785c3ab10053876644834b1
- SHA512 179ec56c04c3c565d7e5b473b9ffa9d8fac3714c8a78c4df0707b180185e4c4129823f88a92538a5ea24fb275d47f7b88f555bb6a9a76a5deb519e07bad27625
- SSDEEP 49152:SDXMFMJYpvi0T5Tc+Ay76cGwMVQrBZzUBeKWprRff3P1+EZ2Qjmuf1yoX6:SDXMFMJoP7gK5dKyPp6
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot bb32 1686813265 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

Score

3^/10

behavioral1

qakbotbb321686813265bankerstealertrojan

Score

10^/10

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Matrix

Tasks

static1

behavioral1