qakbot | d12c8c6869822b02333d2fb6d064774a3ff9eb9844465da5e56fe337ff0cbaeb

Sharing

Copy URL Twitter E-mail

General

Target
9.7z
Size 343KB
Sample230620-tgryfsch75
SHA256 d12c8c6869822b02333d2fb6d064774a3ff9eb9844465da5e56fe337ff0cbaeb
MD5 6f652b9489bf0bf5185db5c67fee1677
SHA1 9514f5f457ae319e7fea49ced19e1168ef589b97
SHA512 fd05ab744cf8bdaaef21cf5947a49943209c4b5b1c65c30defade9e3cf0d2d16c66a1f54a9f94da2d9b4567279e6fe3667a59970606c4aa47fb0664e411c5adc
SSDEEP 6144:+EVrMpRi+UEdCi+nceYFurVTqpMX6GMSMmahylbWd8QtU9FKm7q:pi+JcqceYITqpgahAWd8mUjx7q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

BB32

Campaign

1686735623

86.129.138.170:443
113.11.92.30:443
12.172.173.82:2087
72.205.104.134:443
84.213.236.225:995
92.186.69.229:2222
1.221.179.74:443
103.141.50.43:995
58.162.223.233:443
96.242.126.116:2222
92.154.17.149:2222
75.109.111.89:443
125.99.76.102:443
80.12.88.148:2222
109.149.147.195:2222
27.99.32.26:2222
70.28.50.223:3389
70.28.50.223:32100
86.97.96.62:2222
66.241.183.99:443
74.12.146.45:2222
190.199.147.209:2222
47.205.25.170:443
12.172.173.82:993
12.172.173.82:22
84.35.26.14:995
72.134.124.16:443
85.240.173.251:2078
50.68.186.195:443
65.190.242.244:443
45.62.75.217:443
203.109.44.236:995
174.58.146.57:443
105.184.159.9:995
94.207.115.105:443
197.0.146.211:443
197.204.11.218:443
92.9.45.20:2222
91.169.12.198:32100
12.172.173.82:20
70.64.77.115:443
71.31.9.49:995
24.234.220.88:990
95.45.50.93:2222
213.91.235.146:443
189.223.184.79:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
12.172.173.82:465
67.219.197.94:443
103.140.174.20:2222
12.172.173.82:995
90.29.86.138:2222
37.14.229.220:2222
89.181.227.42:2222
62.35.230.21:995
70.160.67.203:443
88.126.94.4:50000
203.219.204.180:443
147.219.4.194:443
92.20.204.198:2222
24.234.220.88:993
188.28.19.84:443
89.115.200.234:443
67.87.119.216:2083
86.98.222.20:443
161.142.100.114:995
103.139.242.6:443
103.123.223.153:443
24.234.220.88:995
102.158.231.164:443
175.156.65.126:2222
41.227.190.59:443
178.175.187.254:443
180.151.13.23:2078
12.172.173.82:50001
116.75.63.143:443
74.12.146.45:2083
78.192.109.105:2222
37.186.55.8:2222
121.121.100.202:995
104.35.24.154:443
199.27.66.213:443
181.165.19.254:443
81.229.117.95:2222
12.172.173.82:21
45.2.61.134:3389
162.248.14.107:443
103.212.19.254:995
2.82.8.80:443
103.144.201.63:2078
114.143.176.237:443
103.113.68.33:443
77.126.99.230:443
47.21.51.138:443
197.86.195.10:443
36.152.128.5:2222
12.172.173.82:32101
86.248.228.57:2078
92.149.250.113:2222
70.28.50.223:1194
82.127.153.75:2222
78.159.145.7:995
82.125.44.236:2222
24.234.220.88:465
64.121.161.102:443
187.199.244.117:32103
122.184.143.86:443
79.168.224.165:2222
65.30.139.145:995
151.62.174.154:443
124.122.47.148:443
31.190.240.11:443
92.239.81.124:443
31.53.29.210:2222
172.115.17.50:443
70.28.50.223:2083
124.149.143.189:2222

Targets

- Target
  loader/3.dll
- Size 833KB
- SHA256 0fb7b6a296ffa9e0f399d14ba0913d419781a28c2b1c93f4b77c2b1f66d6e71b
- MD5 d7c4fe09863d32f120b9c9f8482f91e2
- SHA1 99bd1ccb34ff47f5299f359349d5733bc0db5b64
- SHA512 8ff8a04b9fb251d62d2dfb47ac53c13ed58913a7c61653ce1097ee3c6733bb40d4d8010028193dba346bf2e3d340ac61a22b9f73de3cfb19fed127255226057f
- SSDEEP 24576:3C4lIeA97+mgxDkID8c4aykLy6GNZDjf:37iovQatLy
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1 behavioral2
- Target
  loader/loader.bat
- Size 39B
- SHA256 e789899d717cec72308924d3cba1daca17c6d2a93214d4d7b47f75a77ba29cd1
- MD5 6bf98143e1fe98d1cf77c8730396bb22
- SHA1 38a219ce77e6dde8e91bef23fd518836a6e384c6
- SHA512 0c10604f30ff0eacb265c871a432e7a6b1474af65b46f6ddb075c4aa5ed4332e024de52df433eaa5908c5caffb32299844ebbeed88550b0306371043f8057308
- MD5 SHA1 SHA512
Score

10^/10

qakbot bb32 1686735623 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral3 behavioral4

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4