qakbot | 1e76b010505c5831c2153bed026f79467984c1c633bb8ef3f3788fc7a26f24e4

Sharing

Copy URL Twitter E-mail

General

Target
62a41c2d1cec79061e66ae0394e82205
Size 825KB
Sample231219-vec7ysbea6
SHA256 1e76b010505c5831c2153bed026f79467984c1c633bb8ef3f3788fc7a26f24e4
MD5 62a41c2d1cec79061e66ae0394e82205
SHA1 20e3187e1e6f57eb9c71ac1ca791cccc83f2b503
SHA512 67ebd32f13a151744f999686ad4b9b0c6b48165ae7b4776a391e26615977092a9024b22795a019dbfaf188d585a1792ee49d242073124e1e51f08e28b1773897
SSDEEP 24576:YsjCOuBER57hemWxOVCy632yHAMnbOMmpK6kMXL9vM+GGVdrhD/lIF:Yyr57hemWxOVCytCrbxmpvXB0+XVd9DO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama111

Campaign

1633590450

37.210.152.224:995
201.93.111.2:995
202.134.178.157:443
89.101.97.139:443
73.52.50.32:443
188.55.235.110:995
27.223.92.142:995
181.118.183.94:443
136.232.34.70:443
186.32.163.199:443
72.173.78.211:443
76.25.142.196:443
120.150.218.241:995
185.250.148.74:443
89.137.52.44:443
66.103.170.104:2222
188.50.169.158:443
174.54.193.186:443
103.148.120.144:443
140.82.49.12:443
216.201.162.158:443
73.230.205.91:443
200.232.214.222:995
103.142.10.177:443
45.46.53.140:2222
124.123.42.115:2222
74.72.237.54:443
41.228.22.180:443
209.142.97.161:995
122.11.220.212:2222
78.191.58.219:995
94.200.181.154:443
47.22.148.6:443
96.57.188.174:2078
68.13.157.69:0
209.50.20.255:443
98.157.235.126:443
173.21.10.71:2222
73.151.236.31:443
71.74.12.34:443
199.27.127.129:443
75.75.179.226:443
167.248.117.81:443
67.165.206.193:993
47.40.196.233:2222
72.252.201.69:443
86.8.177.143:443
181.4.53.6:465
109.12.111.14:443
24.171.50.5:443
24.139.72.117:443
24.55.112.61:443
24.229.150.54:995
77.57.204.78:443
81.250.153.227:2222
49.33.237.65:443
66.177.215.152:50010
177.170.201.134:995
75.188.35.168:443
2.222.167.138:443
120.151.47.189:443
81.241.252.59:2078
173.25.162.221:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
39.52.229.8:995
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
69.30.186.190:443
189.131.221.201:443
68.204.7.158:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
24.119.214.7:443
63.70.164.200:995
177.94.125.59:995
82.18.173.253:2222
73.130.180.25:443
217.17.56.163:2078
162.244.227.34:443
75.66.88.33:443
206.47.134.234:2222
167.248.54.34:2222
73.77.87.137:443
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
162.210.220.137:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
105.198.236.99:443
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
110.174.64.179:995
187.101.25.96:32100
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
68.117.229.117:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
76.84.226.17:443
68.13.157.69:443
167.248.126.223:443
72.196.22.184:443
98.22.92.139:995
97.98.130.50:443
196.117.224.53:995
191.191.38.8:443
188.210.210.122:443
96.46.103.109:2222
37.117.191.19:2222
197.90.137.161:61201
24.32.174.175:443
76.84.225.21:443
78.145.153.73:995
69.30.190.105:995
167.248.81.60:443
69.80.113.148:443
217.17.56.163:443
62.23.194.38:443
62.23.194.41:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
69.253.197.100:443
174.59.242.9:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  62a41c2d1cec79061e66ae0394e82205
- Size 825KB
- SHA256 1e76b010505c5831c2153bed026f79467984c1c633bb8ef3f3788fc7a26f24e4
- MD5 62a41c2d1cec79061e66ae0394e82205
- SHA1 20e3187e1e6f57eb9c71ac1ca791cccc83f2b503
- SHA512 67ebd32f13a151744f999686ad4b9b0c6b48165ae7b4776a391e26615977092a9024b22795a019dbfaf188d585a1792ee49d242073124e1e51f08e28b1773897
- SSDEEP 24576:YsjCOuBER57hemWxOVCy632yHAMnbOMmpK6kMXL9vM+GGVdrhD/lIF:Yyr57hemWxOVCytCrbxmpvXB0+XVd9DO
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot obama111 1633590450 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2