Overview

overview

10

Static

static

10

old_unpacked_qbot.dll

windows7-x64

10

old_unpacked_qbot.dll

windows10-2004-x64

10

Resubmissions

31-10-2023 16:23

231031-tvvw9sba41 10

25-10-2023 22:14

231025-15mf7sha9z 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    old_unpacked_qbot.bin

  • Size

    120KB

  • Sample

    231031-tvvw9sba41

  • MD5

    35927b301d9cd6c33a927b97dccf6266

  • SHA1

    1ccb9ec68f0fd685a58b1b6d2e78ba3b878783da

  • SHA256

    18df034ee69d675ce1b04b95569154f0e3fe41c8bd6a00e59e8dae24b41ed7f7

  • SHA512

    0cbbe3dbc6fea05760801bb812a8eac2b981f55a45aa994112e822e9f8f6741ae5052bab25dd1ab29d65e4b05fe353a0c796b9f8c0ddc4d89a03c13da69e081b

  • SSDEEP

    1536:DCEh82pWrjickOZol59ZJkCZuH6cYTUk8JrNZmwmIOvnToIfwsbuYkR:WH5r+ckl57J4HpYTaJBZfE/TBfwkuYk

Score
10/10
qakbotobama1251636625439bankerevasionstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama125

Campaign

1636625439

C2

117.198.155.237:443

190.73.3.148:2222

63.143.92.99:995

216.238.71.31:443

216.238.72.121:995

216.238.71.31:995

216.238.72.121:443

105.198.236.99:995

136.232.34.70:443

41.37.243.129:443

140.82.49.12:443

71.13.93.154:2222

96.246.158.154:995

102.65.38.57:443

71.13.93.154:6881

123.252.190.14:443

45.9.20.200:2211

136.143.11.232:443

103.143.8.71:995

103.142.10.177:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      old_unpacked_qbot.bin

    • Size

      120KB

    • MD5

      35927b301d9cd6c33a927b97dccf6266

    • SHA1

      1ccb9ec68f0fd685a58b1b6d2e78ba3b878783da

    • SHA256

      18df034ee69d675ce1b04b95569154f0e3fe41c8bd6a00e59e8dae24b41ed7f7

    • SHA512

      0cbbe3dbc6fea05760801bb812a8eac2b981f55a45aa994112e822e9f8f6741ae5052bab25dd1ab29d65e4b05fe353a0c796b9f8c0ddc4d89a03c13da69e081b

    • SSDEEP

      1536:DCEh82pWrjickOZol59ZJkCZuH6cYTUk8JrNZmwmIOvnToIfwsbuYkR:WH5r+ckl57J4HpYTaJBZfE/TBfwkuYk

    Score
    10/10
    qakbotobama1251636625439bankerstealertrojanevasion

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

      trojanbankerstealerqakbot

    • Windows security bypass

      evasiontrojan

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks