General

  • Target

    4b432a7a66293a8ec5b960d0bbb949d917cef95149eb55579c46a362987741fe

  • Size

    1.2MB

  • Sample

    230830-yy7sfshh51

  • MD5

    37000c1856cbc7e59719ab74ab9724d2

  • SHA1

    7b8ee9eabb08aa481ecd8b9b168ae52c8a906df4

  • SHA256

    4b432a7a66293a8ec5b960d0bbb949d917cef95149eb55579c46a362987741fe

  • SHA512

    721b1a322b9ffe021234ff03238c06c7ae5d82cfe9185df4437957f1ed30500548755980a7717fb275c0b11a22830e6e68e7c4a8ad5d94990747857f08544723

  • SSDEEP

    6144:ntBgdSr2faSrTBRc6nWFo1x3R1C1HVi1aaJVeTy5RGDCgu4YlLbvFyAVIP:x2fRrTBHWIjM1kHaWOW3B/6

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx131

Campaign

1591077865

C2

73.226.220.56:443

98.148.177.77:443

207.255.161.8:443

72.190.101.70:443

100.38.123.22:443

50.104.186.71:443

67.249.222.14:443

104.235.61.64:443

207.255.161.8:2222

71.197.180.27:443

72.209.191.27:443

64.19.74.29:995

71.209.67.223:2222

98.115.138.61:443

75.87.161.32:995

58.233.220.182:443

68.174.15.223:443

50.244.112.10:443

76.187.8.160:443

173.22.120.11:2222

Targets

    • Target

      4b432a7a66293a8ec5b960d0bbb949d917cef95149eb55579c46a362987741fe

    • Size

      1.2MB

    • MD5

      37000c1856cbc7e59719ab74ab9724d2

    • SHA1

      7b8ee9eabb08aa481ecd8b9b168ae52c8a906df4

    • SHA256

      4b432a7a66293a8ec5b960d0bbb949d917cef95149eb55579c46a362987741fe

    • SHA512

      721b1a322b9ffe021234ff03238c06c7ae5d82cfe9185df4437957f1ed30500548755980a7717fb275c0b11a22830e6e68e7c4a8ad5d94990747857f08544723

    • SSDEEP

      6144:ntBgdSr2faSrTBRc6nWFo1x3R1C1HVi1aaJVeTy5RGDCgu4YlLbvFyAVIP:x2fRrTBHWIjM1kHaWOW3B/6

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks