qakbot | 72c28bc50f1983d49271271df5c7317cc3cc98db6eb4a0f787125b2ad43d7c4b

Sharing

Copy URL Twitter E-mail

General

Target
posstt.dll
Size 1.1MB
Sample230621-sjs3vsbd7t
SHA256 72c28bc50f1983d49271271df5c7317cc3cc98db6eb4a0f787125b2ad43d7c4b
MD5 b9215b2b8a5c5bc6ffa2e8d079cd9afc
SHA1 4c227d81dc18c06ff6769f1529dbe2fd4dca0c62
SHA512 5b7c080d2b1699124cda7bf03e88a3b092ed044a017198d74946ad6664f2be4ec47191119769b3dd7d17ba31f974d5219ef1462c672522bb3c626277f4c14827
SSDEEP 24576:l3sUlO2TYFXw4M+B08NptUduyNVUnxM/jj5wDe2t:S5zVBHptAnUxSSe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.1382

Botnet

BB33

Campaign

1687343976

149.74.159.67:2222
184.176.35.223:2222
87.149.121.9:995
89.129.109.27:2222
151.62.196.183:443
24.198.114.130:995
96.87.28.170:2222
213.55.33.103:443
12.172.173.82:22
41.228.207.158:995
90.162.45.154:2222
102.130.200.134:2078
64.43.14.50:443
198.2.51.242:993
47.34.30.133:443
70.51.247.250:2222
168.149.47.12:443
68.186.65.132:443
88.126.94.4:50000
70.28.50.223:3389
70.49.205.191:2222
183.87.163.165:443
162.248.14.107:443
70.28.50.223:32100
147.147.30.126:2222
1.221.179.74:443
102.158.46.89:443
201.171.159.196:443
82.125.44.236:2222
98.4.43.111:443
2.82.8.80:443
81.150.169.174:2083
70.54.111.35:2222
103.153.180.60:995
184.176.110.61:61202
86.128.15.251:2222
70.160.67.203:443
12.172.173.82:50001
75.98.154.19:443
70.28.50.223:2078
67.87.119.216:2078
95.45.50.93:2222
72.4.96.62:443
213.64.33.92:2222
165.120.244.223:2222
70.28.50.223:2087
175.156.65.126:2222
47.205.25.170:443
86.178.33.59:2222
81.150.169.174:2078
91.165.188.74:50000
66.241.183.99:443
220.79.238.82:443
23.234.237.3:443
76.178.148.107:2222
136.232.179.26:443
92.186.69.229:2222
12.172.173.82:993
151.69.32.238:443
91.182.163.36:2222
174.4.89.3:443
119.82.95.142:2078
199.27.66.213:443
92.20.204.198:2222
84.35.26.14:995
81.229.117.95:2222
91.254.145.252:443
92.9.45.20:2222
12.172.173.82:20
91.169.12.198:32100
213.91.235.146:443
188.28.77.187:443
12.172.173.82:465
70.28.50.223:1194
201.208.135.13:2222
24.234.80.122:995
81.150.169.174:2222
121.121.100.202:995
105.184.8.190:995
12.172.173.82:21
184.182.66.109:443
64.229.117.208:2222
77.126.99.230:443
80.12.88.148:2222
87.252.106.235:995
12.172.173.82:32101
201.225.216.60:2222
116.88.76.28:443
217.165.255.105:443
92.27.86.48:2222
103.123.223.131:443
90.104.151.37:2222
27.0.48.233:443
72.205.104.134:443
12.172.173.82:2087
31.53.29.188:2222
37.14.229.220:2222
89.181.227.42:2222
182.75.189.42:995
62.35.230.21:995
198.255.148.59:443
88.171.156.150:50000
89.152.20.11:2222
161.142.100.114:995
122.184.143.84:443
223.166.13.95:995
197.83.246.187:443
79.168.224.165:2222
201.244.108.183:995
178.175.187.254:443
176.142.207.63:443
86.160.253.50:443
116.75.63.162:443
103.141.50.46:995
41.129.104.142:443
92.188.241.102:443
103.212.19.254:995
172.115.17.50:443
2.49.63.237:2222

Targets

- Target
  posstt.dll
- Size 1.1MB
- SHA256 72c28bc50f1983d49271271df5c7317cc3cc98db6eb4a0f787125b2ad43d7c4b
- MD5 b9215b2b8a5c5bc6ffa2e8d079cd9afc
- SHA1 4c227d81dc18c06ff6769f1529dbe2fd4dca0c62
- SHA512 5b7c080d2b1699124cda7bf03e88a3b092ed044a017198d74946ad6664f2be4ec47191119769b3dd7d17ba31f974d5219ef1462c672522bb3c626277f4c14827
- SSDEEP 24576:l3sUlO2TYFXw4M+B08NptUduyNVUnxM/jj5wDe2t:S5zVBHptAnUxSSe
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot bb33 1687343976 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2