qakbot | 974c71eeabcf4112e5b8426c6411cadd5bf6d9b6000c342c69d11be898481649

Resubmissions

16/06/2023, 16:16

230616-tq64qsfe3z10

16/06/2023, 15:59

230616-te8s7afd8s3

Sharing

Copy URL Twitter E-mail

General

Target
threatenedNeuromastic.dll
Size 2.1MB
Sample230616-tq64qsfe3z
SHA256 974c71eeabcf4112e5b8426c6411cadd5bf6d9b6000c342c69d11be898481649
MD5 766fa541d13961e0ab3f2b0d61ef49aa
SHA1 bbebd4b9e6ec0095fb6dc13bcaf04338c7bcad4a
SHA512 6f4865bcb38f0e622a0cf25beb9d7ed724b6924289a479bbafbcf4bafb08ecd5251f8444ef861acb5615c4544f24bf2a0842e09e47fb76811cbe1830305b93fd
SSDEEP 49152:/jz3HgNzPVQ4FzdB5fYCjMiC2uH+QjaE6j+l/ZZvmu2dxMgLiv:7gZo2uHrJ6e/Z9QdxMIi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

BB32

Campaign

1686908761

86.176.144.175:2222
86.248.228.57:2078
88.171.156.150:50000
183.87.163.165:443
45.201.208.87:443
74.12.147.205:2222
96.87.28.170:2222
70.28.50.223:32100
220.79.238.82:443
12.172.173.82:995
45.2.61.134:3389
70.160.67.203:443
103.141.50.45:995
88.126.94.4:50000
70.28.50.223:3389
142.181.206.222:2222
51.37.181.9:443
223.166.13.95:995
162.248.14.107:443
95.45.50.93:2222
213.64.33.92:2222
213.91.235.146:443
189.223.184.79:443
47.34.30.133:443
70.28.50.223:2087
12.172.173.82:465
47.205.25.170:443
39.40.59.71:2222
103.140.174.20:2222
66.241.183.99:443
23.234.237.3:443
12.172.173.82:993
203.109.44.236:995
174.4.89.3:443
88.122.221.227:443
84.35.26.14:995
142.154.32.124:443
184.82.238.145:443
24.234.220.88:993
12.172.173.82:50001
217.129.220.205:443
92.9.45.20:2222
90.29.86.138:2222
91.169.12.198:32100
12.172.173.82:20
70.28.50.223:2078
188.28.19.84:443
92.20.204.198:2222
92.186.69.229:2222
161.142.100.114:995
197.26.147.241:995
199.27.66.213:443
41.97.30.206:443
136.232.179.26:443
200.112.67.75:32100
92.97.227.66:2222
197.0.146.211:443
176.142.207.63:443
37.14.229.220:2222
184.181.75.148:443
89.181.227.42:2222
89.114.140.100:443
181.230.169.180:443
103.176.239.98:443
41.100.36.90:443
103.123.223.153:443
184.182.66.109:443
70.28.50.223:2083
47.21.51.138:443
77.126.99.230:443
12.172.173.82:32101
116.88.76.28:443
116.74.163.180:443
72.4.96.62:443
71.30.208.132:995
178.175.187.254:443
24.234.220.88:995
24.234.220.88:465
70.28.50.223:1194
85.61.165.153:2222
217.165.255.105:443
119.82.91.60:2078
121.121.100.202:995
105.186.242.215:995
81.229.117.95:2222
41.129.104.142:443
12.172.173.82:21
122.184.143.86:443
85.240.173.251:2078
70.48.46.235:2222
124.122.47.148:443
114.143.176.237:443
86.160.253.50:443
184.176.35.223:2222
172.115.17.50:443
47.199.241.39:443
124.246.122.199:2222
89.32.156.4:995
92.149.250.113:2222
87.149.116.32:995
72.205.104.134:443
110.159.115.244:443
82.127.153.75:2222
64.121.161.102:443
187.199.244.117:32103
12.172.173.82:2087
74.12.147.205:2083
84.213.236.225:995
86.164.33.69:995
98.4.43.111:443
79.168.224.165:2222
197.204.28.90:443
89.129.109.27:2222
76.178.148.107:2222
77.86.98.236:443
83.114.60.6:2222
90.78.147.141:2222
201.244.108.183:995
45.62.75.217:443

Targets

- Target
  threatenedNeuromastic.dll
- Size 2.1MB
- SHA256 974c71eeabcf4112e5b8426c6411cadd5bf6d9b6000c342c69d11be898481649
- MD5 766fa541d13961e0ab3f2b0d61ef49aa
- SHA1 bbebd4b9e6ec0095fb6dc13bcaf04338c7bcad4a
- SHA512 6f4865bcb38f0e622a0cf25beb9d7ed724b6924289a479bbafbcf4bafb08ecd5251f8444ef861acb5615c4544f24bf2a0842e09e47fb76811cbe1830305b93fd
- SSDEEP 49152:/jz3HgNzPVQ4FzdB5fYCjMiC2uH+QjaE6j+l/ZZvmu2dxMgLiv:7gZo2uHrJ6e/Z9QdxMIi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot bb32 1686908761 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2