qakbot | fd1e4ecef5aed84a1e9cf04271111c5041d6c50c850b75959932927cf875293a

Sharing

Copy URL Twitter E-mail

General

Target
20efcddcbdd32c1b9648a4d50d2a29bb_JaffaCakes118
Size 221KB
Sample240507-swclmsda2v
SHA256 fd1e4ecef5aed84a1e9cf04271111c5041d6c50c850b75959932927cf875293a
MD5 20efcddcbdd32c1b9648a4d50d2a29bb
SHA1 b36284f8d8f3a193ef9f0aa2465eee0deca99d94
SHA512 067da669c2d212537426a4027cfb326216c5fb31f4e2cbbc881dc0a6cf99688a303b076b9256f87243d75b19b73ac475400c4a30da8aa6bacce66bd2c59ca8a4
SSDEEP 6144:afb0rHntqUtSsDWXjU5YVFsWfefYwd8h:hksDMjU5YVaWkd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

324.70

Botnet

spx85

Campaign

1585321881

201.152.111.104:995
181.197.195.138:995
96.35.170.82:2222
50.244.112.10:443
174.126.230.25:443
74.33.70.220:443
72.80.137.215:443
86.121.120.255:443
108.190.151.108:2222
70.166.158.118:443
24.229.245.124:995
71.187.170.235:443
49.191.6.183:995
71.80.45.253:443
46.214.62.199:443
76.107.242.174:443
79.116.229.1:995
31.5.172.53:443
71.172.110.236:443
94.98.82.131:443
73.60.148.209:443
104.235.125.137:443
188.27.27.227:443
97.78.107.14:443
188.26.131.41:443
174.104.23.7:443
47.39.76.74:443
98.27.176.35:443
104.34.122.18:443
104.174.71.153:2222
89.34.231.30:443
173.69.58.179:443
24.184.5.251:2222
79.113.116.216:443
81.245.66.237:995
98.219.77.197:443
207.255.18.67:443
78.97.116.41:443
100.1.239.189:443
208.93.202.49:443
173.63.217.48:443
206.169.163.147:995
73.226.220.56:443
71.197.126.250:443
70.37.212.176:995
72.142.106.198:465
98.190.24.81:443
187.194.16.208:2222
68.116.193.239:443
93.114.89.119:995
85.204.189.105:443
173.173.68.41:443
137.119.71.87:443
24.110.14.40:443
187.19.151.218:995
100.4.185.8:443
72.36.59.46:2222
5.2.149.216:443
83.25.14.84:2222
173.173.1.164:443
72.36.11.22:443
78.97.145.242:443
75.110.250.89:443
190.204.58.240:2078
24.55.152.50:995
46.214.86.45:443
47.202.98.230:443
159.242.41.235:443
70.57.15.187:993
74.105.139.160:443
24.46.40.189:2222
100.38.123.22:443
24.186.50.78:443
67.7.2.109:2222
71.220.222.169:443
72.190.124.29:443
72.218.167.183:995
72.16.212.107:465
173.3.132.17:995
72.190.101.70:443
104.152.16.45:995
70.62.160.186:6883
98.116.62.242:443
74.129.26.223:443
24.201.79.208:2078
85.7.22.186:2222
79.119.74.176:443
67.251.155.12:443
12.5.37.3:443
89.43.208.246:443
78.96.148.177:443
73.169.47.57:443
45.247.216.164:443
24.110.96.149:443
98.118.156.172:443
46.153.111.112:995
184.176.139.8:443
88.158.200.203:443
172.95.42.35:443
86.126.197.176:443
67.165.206.193:995
79.127.79.210:995
73.23.194.75:443
206.255.163.120:443
74.109.200.208:443
65.30.12.240:443
100.40.48.96:443
84.247.55.190:443
89.137.162.193:443
94.59.237.62:995
75.111.145.5:443
68.174.15.223:443
71.182.142.63:443
64.19.74.29:995
63.155.135.211:995
75.82.228.209:443
69.246.151.5:443
47.153.115.154:993
71.77.252.14:2222
24.37.178.158:443
209.213.30.152:443
97.81.255.189:443
72.29.181.77:2078
73.76.47.127:443
47.39.177.171:2222
82.77.166.92:443
95.77.237.115:443
76.23.204.29:443
68.49.120.179:443
98.213.28.175:443
50.244.112.106:443
86.125.180.36:995
72.255.200.129:2222
47.180.66.10:443
72.209.191.27:443
99.229.5.63:995
184.180.157.203:2222
70.191.103.164:443
71.193.126.206:443
5.13.94.54:443
148.75.231.53:443
74.75.237.11:443
181.126.86.223:443
71.226.90.153:443
68.225.250.136:443
75.183.171.155:3389
98.164.253.75:443
50.115.187.139:443
137.99.224.198:443
66.26.160.37:443

Targets

- Target
  20efcddcbdd32c1b9648a4d50d2a29bb_JaffaCakes118
- Size 221KB
- SHA256 fd1e4ecef5aed84a1e9cf04271111c5041d6c50c850b75959932927cf875293a
- MD5 20efcddcbdd32c1b9648a4d50d2a29bb
- SHA1 b36284f8d8f3a193ef9f0aa2465eee0deca99d94
- SHA512 067da669c2d212537426a4027cfb326216c5fb31f4e2cbbc881dc0a6cf99688a303b076b9256f87243d75b19b73ac475400c4a30da8aa6bacce66bd2c59ca8a4
- SSDEEP 6144:afb0rHntqUtSsDWXjU5YVFsWfefYwd8h:hksDMjU5YVaWkd
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2