qakbot | a27df79ba5f04d6a09189e6d01c301e6ddbf082c67c2853ec2f4bbfdf2b51a56

Sharing

Copy URL Twitter E-mail

General

Target
a27df79ba5f04d6a09189e6d01c301e6ddbf082c67c2853ec2f4bbfdf2b51a56
Size 1.5MB
Sample240226-1fe1tsge92
SHA256 a27df79ba5f04d6a09189e6d01c301e6ddbf082c67c2853ec2f4bbfdf2b51a56
MD5 e1dbda07124bece1d5d847715c28afbc
SHA1 95bb7058f29ddcec37aaaa0e3348e30361e86d38
SHA512 c07332e92435dc83b4aa8368f041d873f22e7977658027a8085da7bf96d47352b1e11ff6cca52517790da08493e21f43d8b8f2314a6f775ad3555b2faf01b3ee
SSDEEP 24576:c/LFmDoE1Zjaqi/3ymfSBjDHubkX0YuSw7zMYQ0a4lFbp:cjivD9EimfEuYXXuSoWx+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot aa 1651135890 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

Campaign

1651135890

149.135.101.20:443
103.139.243.207:990
1.161.104.149:995
185.249.85.175:443
113.89.5.252:995
202.134.152.2:2222
41.107.132.203:443
191.250.245.193:443
117.248.109.38:21
86.195.158.178:2222
71.13.93.154:2222
45.9.20.200:443
103.87.95.133:2222
173.174.216.62:443
187.58.79.229:993
203.122.46.130:443
32.221.224.140:995
175.145.235.37:443
81.155.87.247:2078
140.82.63.183:443
45.76.167.26:443
45.76.167.26:995
149.28.238.199:995
149.28.238.199:443
144.202.2.175:995
144.202.3.39:995
144.202.2.175:443
144.202.3.39:443
140.82.63.183:995
45.63.1.12:995
45.63.1.12:443
70.46.220.114:443
45.241.145.100:995
217.164.210.192:443
5.32.41.45:443
83.110.218.155:993
37.210.160.58:2222
86.98.208.214:2222
92.132.172.197:2222
121.7.223.59:2222
172.114.160.81:995
37.186.54.254:995
196.203.37.215:80
24.178.196.158:2222
120.150.218.241:995
91.177.173.10:995
31.35.28.29:443
24.139.72.117:443
217.128.122.65:2222
82.152.39.39:443
148.0.57.85:443
104.34.212.7:32103
176.67.56.94:443
208.107.221.224:443
182.191.92.203:995
103.88.226.30:443
41.84.234.144:995
103.107.113.120:443
24.152.219.253:995
46.107.48.202:443
197.161.54.85:993
1.161.104.149:443
74.14.7.71:2222
93.48.80.198:995
39.49.7.245:995
80.11.74.81:2222
89.86.33.217:443
2.34.12.8:443
38.70.253.226:2222
47.23.89.62:993
172.114.160.81:443
75.99.168.194:443
108.60.213.141:443
2.50.4.57:443
102.65.38.74:443
69.14.172.24:443
72.76.94.99:443
47.23.89.62:995
41.228.22.180:443
148.64.96.100:443
180.129.20.164:995
140.82.49.12:443
78.180.88.120:443
46.176.222.34:995
187.207.47.198:61202
89.101.97.139:443
103.246.242.202:443
75.99.168.194:61201
197.89.108.36:443
39.52.23.208:995
94.59.56.46:2222
172.115.177.204:2222
39.44.144.64:995
174.69.215.101:443
67.209.195.198:443
94.59.56.46:1194
83.110.94.89:443
31.215.98.103:443
39.57.23.116:995
190.74.239.37:2222
180.183.102.114:2222
67.165.206.193:993
45.46.53.140:2222
102.182.232.3:995
121.74.167.191:995
189.146.78.175:443
173.21.10.71:2222
73.151.236.31:443
76.25.142.196:443
191.99.191.28:443
41.38.167.179:995
187.250.114.15:443
187.208.137.144:443
190.252.242.69:443
37.34.253.233:443
47.156.191.217:443
186.64.67.3:443
70.51.153.227:2222
201.172.23.68:2222
72.12.115.71:22
179.99.49.37:32101
40.134.246.185:995
100.1.108.246:443
24.55.67.176:443
174.95.174.163:2222
101.50.120.166:995
179.158.105.44:443
187.102.135.142:2222
72.252.157.172:990
72.252.157.172:995
191.112.14.1:443
109.12.111.14:443
101.109.187.37:443
94.36.195.250:2222
120.61.3.142:443
84.241.8.23:32103
85.246.82.244:443
39.41.184.13:995
98.22.246.169:443
189.243.13.151:443
63.143.92.99:995
167.86.165.74:443
82.41.63.217:443
188.211.190.128:61202
176.205.194.145:2078
79.129.121.68:995
122.178.90.3:50001
197.94.84.67:443
187.201.245.132:22
187.52.231.156:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  a27df79ba5f04d6a09189e6d01c301e6ddbf082c67c2853ec2f4bbfdf2b51a56
- Size 1.5MB
- SHA256 a27df79ba5f04d6a09189e6d01c301e6ddbf082c67c2853ec2f4bbfdf2b51a56
- MD5 e1dbda07124bece1d5d847715c28afbc
- SHA1 95bb7058f29ddcec37aaaa0e3348e30361e86d38
- SHA512 c07332e92435dc83b4aa8368f041d873f22e7977658027a8085da7bf96d47352b1e11ff6cca52517790da08493e21f43d8b8f2314a6f775ad3555b2faf01b3ee
- SSDEEP 24576:c/LFmDoE1Zjaqi/3ymfSBjDHubkX0YuSw7zMYQ0a4lFbp:cjivD9EimfEuYXXuSoWx+
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot aa 1651135890 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2