General
-
Target
458f62d8f71a81d7d9f863bc625ba0ac358ccfda4a5210d911723647216f3f32
-
Size
1.1MB
-
Sample
230830-yzw3caaf49
-
MD5
96fc89567383d14e13f2fb3be7352ad7
-
SHA1
22c742260a6ac9b6f19a4fa7ea6d409b4faab8d1
-
SHA256
458f62d8f71a81d7d9f863bc625ba0ac358ccfda4a5210d911723647216f3f32
-
SHA512
2d4eaee4e8a7a2b443dda5f48fe5ebb1a4fd6bdc2db97ab0bdfdca07e6fe18cf9132832a08c2ed5d0b479c12de47826593edf8d01d77f2b03fcf698648dac663
-
SSDEEP
12288:flK3pyiZA0yh4loxeC5ZFfO1WMNo61WhEd0lGKjVQcJn:N2pyiZKaoxvzkWMS61EEHKjVQY
Malware Config
Extracted
qakbot
324.142
notset
1590741916
Protocol: ftp- Host:
192.185.5.208 - Port:
21 - Username:
[email protected] - Password:
NxdkxAp4dUsY
Protocol: ftp- Host:
162.241.218.118 - Port:
21 - Username:
[email protected] - Password:
EcOV0DyGVgVN
Protocol: ftp- Host:
69.89.31.139 - Port:
21 - Username:
[email protected] - Password:
fcR7OvyLrMW6!
Protocol: ftp- Host:
169.207.67.14 - Port:
21 - Username:
[email protected] - Password:
eQyicNLzzqPN
108.227.161.27:995
173.187.103.35:443
117.216.185.86:443
24.43.22.220:443
72.190.101.70:443
207.255.161.8:2087
189.160.217.221:443
207.255.161.8:32102
24.226.137.154:443
66.222.88.126:995
108.58.9.238:995
1.40.42.4:443
47.152.210.233:443
72.45.14.185:443
82.127.193.151:2222
101.108.113.6:443
175.111.128.234:995
175.111.128.234:443
47.39.76.74:443
5.12.214.109:2222
Targets
-
-
Target
458f62d8f71a81d7d9f863bc625ba0ac358ccfda4a5210d911723647216f3f32
-
Size
1.1MB
-
MD5
96fc89567383d14e13f2fb3be7352ad7
-
SHA1
22c742260a6ac9b6f19a4fa7ea6d409b4faab8d1
-
SHA256
458f62d8f71a81d7d9f863bc625ba0ac358ccfda4a5210d911723647216f3f32
-
SHA512
2d4eaee4e8a7a2b443dda5f48fe5ebb1a4fd6bdc2db97ab0bdfdca07e6fe18cf9132832a08c2ed5d0b479c12de47826593edf8d01d77f2b03fcf698648dac663
-
SSDEEP
12288:flK3pyiZA0yh4loxeC5ZFfO1WMNo61WhEd0lGKjVQcJn:N2pyiZKaoxvzkWMS61EEHKjVQY
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-