General
-
Target
e10d90f8e22f29a22f8657ca2064bdc1
-
Size
573KB
-
Sample
231220-tgps4aefar
-
MD5
e10d90f8e22f29a22f8657ca2064bdc1
-
SHA1
aa5310d1e888dc200ea7c2e5feb31f6c572480c7
-
SHA256
90d20295ce4953c7b479857a4d369025fd415dfeb71efecbff931c85764c3fd8
-
SHA512
38b04e19b620c7fdcd5d20f6d0583513650fe7f4e5290c04e0a8e322ff30e5aa986404b316fe99ffb5b152b34bf9dc9dcc2541d84c1c01c158f21409927e3d7e
-
SSDEEP
12288:C87H3sH2k/eG9A9tqKsuud0/l0pT7fEztxG9HBMbVNADirS:CSs7/RYtq4E3MzO9HoH4s
Malware Config
Extracted
qakbot
402.363
obama107
1633078880
140.82.49.12:443
41.250.143.109:995
216.201.162.158:443
86.8.177.143:443
105.198.236.99:443
124.123.42.115:2222
217.17.56.163:443
37.210.152.224:995
190.198.206.189:2222
75.89.195.186:995
78.191.44.76:995
122.11.220.212:2222
68.186.192.69:443
159.2.51.200:2222
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
120.151.47.189:443
47.22.148.6:443
94.200.181.154:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Targets
-
-
Target
e10d90f8e22f29a22f8657ca2064bdc1
-
Size
573KB
-
MD5
e10d90f8e22f29a22f8657ca2064bdc1
-
SHA1
aa5310d1e888dc200ea7c2e5feb31f6c572480c7
-
SHA256
90d20295ce4953c7b479857a4d369025fd415dfeb71efecbff931c85764c3fd8
-
SHA512
38b04e19b620c7fdcd5d20f6d0583513650fe7f4e5290c04e0a8e322ff30e5aa986404b316fe99ffb5b152b34bf9dc9dcc2541d84c1c01c158f21409927e3d7e
-
SSDEEP
12288:C87H3sH2k/eG9A9tqKsuud0/l0pT7fEztxG9HBMbVNADirS:CSs7/RYtq4E3MzO9HoH4s
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Windows security bypass
-
Loads dropped DLL
-