General
-
Target
ec5702b803de813dbbcae69a2427d1fc
-
Size
573KB
-
Sample
231220-t9mjfahef2
-
MD5
ec5702b803de813dbbcae69a2427d1fc
-
SHA1
e8a74a8db218b06dc1ecfce0147ef46deebd558f
-
SHA256
ba7e19741fdd2bc1562f7be45830906c2dc2310720afb17b7c435b0197bffa5d
-
SHA512
b7e987afcfebaed5c22915b4c3c454190d55515ba6ca613dd5e1c4bfd7d8c3cabc84aff26da5f7de98127b4514fcb2b4ac7e17f1d7d028e2f09e518d124944b9
-
SSDEEP
12288:e87H3sH2k/e09A9tqKsuud0fl0pT7fEztxG9HBMbVNAfirS:eSs7/nYtqoE3MzO9HoHks
Malware Config
Extracted
qakbot
402.363
obama107
1633078880
140.82.49.12:443
41.250.143.109:995
216.201.162.158:443
86.8.177.143:443
105.198.236.99:443
124.123.42.115:2222
217.17.56.163:443
37.210.152.224:995
190.198.206.189:2222
75.89.195.186:995
78.191.44.76:995
122.11.220.212:2222
68.186.192.69:443
159.2.51.200:2222
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
120.151.47.189:443
47.22.148.6:443
94.200.181.154:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Targets
-
-
Target
ec5702b803de813dbbcae69a2427d1fc
-
Size
573KB
-
MD5
ec5702b803de813dbbcae69a2427d1fc
-
SHA1
e8a74a8db218b06dc1ecfce0147ef46deebd558f
-
SHA256
ba7e19741fdd2bc1562f7be45830906c2dc2310720afb17b7c435b0197bffa5d
-
SHA512
b7e987afcfebaed5c22915b4c3c454190d55515ba6ca613dd5e1c4bfd7d8c3cabc84aff26da5f7de98127b4514fcb2b4ac7e17f1d7d028e2f09e518d124944b9
-
SSDEEP
12288:e87H3sH2k/e09A9tqKsuud0fl0pT7fEztxG9HBMbVNAfirS:eSs7/nYtqoE3MzO9HoHks
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Windows security bypass
-
Loads dropped DLL
-