General
-
Target
e35cb2b971cc43d515eb1bf22cc6e981
-
Size
573KB
-
Sample
231220-tm14baagd5
-
MD5
e35cb2b971cc43d515eb1bf22cc6e981
-
SHA1
c5c81df36db5fac9b8866252f73791f553ae269b
-
SHA256
cc210e4d7466f6a2b22dd37bd0a6b790e7fa307b85ab8c19b8b42ad1b2bb31c2
-
SHA512
85af3ec67eb6d0538dfe6143555be972f7556a1d182193dd31402d395ec50205f8c3c44799189dcb27c0f5fc41385d8ef1889a493284e3669515ff734f1516dd
-
SSDEEP
12288:c87H3sH2k/e89A9tqKsuud0jl0pT7fEztxG9HBMbVNAfirS:cSs7/HYtqsE3MzO9HoHUs
Malware Config
Extracted
qakbot
402.363
obama107
1633078880
140.82.49.12:443
41.250.143.109:995
216.201.162.158:443
86.8.177.143:443
105.198.236.99:443
124.123.42.115:2222
217.17.56.163:443
37.210.152.224:995
190.198.206.189:2222
75.89.195.186:995
78.191.44.76:995
122.11.220.212:2222
68.186.192.69:443
159.2.51.200:2222
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
120.151.47.189:443
47.22.148.6:443
94.200.181.154:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Targets
-
-
Target
e35cb2b971cc43d515eb1bf22cc6e981
-
Size
573KB
-
MD5
e35cb2b971cc43d515eb1bf22cc6e981
-
SHA1
c5c81df36db5fac9b8866252f73791f553ae269b
-
SHA256
cc210e4d7466f6a2b22dd37bd0a6b790e7fa307b85ab8c19b8b42ad1b2bb31c2
-
SHA512
85af3ec67eb6d0538dfe6143555be972f7556a1d182193dd31402d395ec50205f8c3c44799189dcb27c0f5fc41385d8ef1889a493284e3669515ff734f1516dd
-
SSDEEP
12288:c87H3sH2k/e89A9tqKsuud0jl0pT7fEztxG9HBMbVNAfirS:cSs7/HYtqsE3MzO9HoHUs
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Windows security bypass
-
Loads dropped DLL
-