qakbot | 9e2864977d0e2bf7e8def198db7d3022188cd764519c2f385797a7ca394c2283

Sharing

Copy URL Twitter E-mail

General

Target
57fc7f0fe915ca5536491079f9f448e3_JaffaCakes118
Size 937KB
Sample240519-ca78escd5t
SHA256 9e2864977d0e2bf7e8def198db7d3022188cd764519c2f385797a7ca394c2283
MD5 57fc7f0fe915ca5536491079f9f448e3
SHA1 35bba208ce5f96c1c4b6632304901bf060eb0212
SHA512 e9cff1b1d8b9145177cbdfcfbaceb79dec034272ca1d88eacba53abd8e10577b13332983a13774ddb46be20469a8ab1cd10b950dc3196b30c34b197f57e0490e
SSDEEP 24576:XHHsQdjpEm3+wso/ykMdeifMcHuWQ4CBxIkjKOa:XHH5FOws8yLei020He
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

323.79

Botnet

spx04

Campaign

1568039940

190.120.196.18:443
70.169.2.228:21
189.160.191.239:443
174.48.72.160:443
99.231.208.9:443
12.5.37.3:443
173.178.129.3:443
189.236.138.168:443
67.41.197.173:2078
173.172.205.216:443
76.69.181.244:995
70.164.39.91:443
75.131.72.82:443
189.236.214.160:995
199.126.92.231:995
98.224.57.108:443
72.142.106.198:995
98.186.90.192:995
72.36.14.160:443
75.177.172.209:6882
67.246.16.250:995
186.48.170.241:443
2.50.171.216:443
206.51.202.106:50003
190.120.196.18:465
73.145.189.17:995
187.233.83.86:443
70.72.222.37:2222
67.183.144.204:443
72.213.98.233:443
90.229.145.250:2222
67.71.130.80:2222
69.4.106.254:443
47.23.101.26:990
50.246.229.50:443
137.25.72.175:443
176.157.2.33:443
75.157.194.173:995
67.214.8.102:443
71.182.142.63:443
184.191.62.78:443
207.179.194.91:443
184.144.65.166:2078
68.225.250.136:443
24.111.196.195:443
47.54.254.139:2222
50.46.131.145:443
24.27.82.216:2222
62.46.63.137:995
98.236.87.243:443
189.155.93.73:443
47.180.66.10:995
173.61.181.106:993
189.140.207.38:443
108.160.123.244:443
181.90.124.162:443
69.57.123.150:443
189.166.121.253:443
189.141.181.204:443
187.194.13.173:443
105.246.76.76:995
74.15.32.205:2222
65.94.90.23:1194
70.50.221.166:2222
197.89.78.186:443
75.56.175.129:995
72.16.212.107:995
64.19.74.29:995
162.244.224.166:443
73.202.121.222:443
89.138.118.87:995
47.153.115.154:995
72.29.181.77:2083
104.3.91.20:995
166.62.129.86:443
190.144.81.158:995
50.247.230.33:443
98.254.147.36:443
72.255.200.129:443
190.162.185.190:0
137.119.216.25:443
75.69.3.12:443
217.162.149.212:443
70.53.246.231:995
181.95.185.22:443
73.136.50.9:443
76.64.15.78:2222
187.163.101.137:995
68.174.15.223:443
73.137.187.150:443
24.229.150.54:995
76.71.76.131:32101
189.158.59.81:443
50.78.93.74:995
72.179.13.59:443
73.226.220.56:443
192.24.181.185:443
166.62.180.194:2078
173.16.78.208:443
67.10.18.112:993
206.51.202.106:50002
108.184.57.213:443
181.197.195.138:995
162.244.225.30:443
47.23.101.26:993
47.136.226.219:443
96.22.239.27:2222
172.78.85.20:443
173.176.203.193:3389
68.59.209.183:995
96.20.238.2:2083
65.94.90.23:3389
65.94.90.23:8443
68.83.59.107:443
68.238.56.27:443
64.20.68.35:2222
73.133.46.105:995
47.214.144.253:443
181.126.80.118:443
67.77.162.13:443
108.14.239.97:443
108.55.23.221:443
64.229.192.230:995
111.125.70.30:2222
104.34.122.18:443
70.74.159.126:2222
24.184.6.58:2222
201.152.106.171:995
173.22.120.11:2222
24.180.7.155:443
184.74.101.234:995
76.85.30.25:995
98.165.206.64:443
70.183.177.71:443
76.116.128.81:443
96.20.238.2:2078
50.100.214.10:2222
67.10.18.112:995
12.5.37.3:995
69.70.37.246:465
108.45.183.59:443
99.228.242.183:995
70.166.97.7:465
148.163.2.101:443
181.25.141.71:995
47.146.173.204:443
184.180.157.203:2222
138.122.5.214:2222

Targets

- Target
  Wong_B.vbs
- Size 1.9MB
- SHA256 798e44b2af6329ac38f144d816096b72889009f44c9d74aefa36c11dbdc5522a
- MD5 32432f63ce811f734d1938060fe83b4c
- SHA1 e768c6bf965a548f8e8e79413d67998ee5173364
- SHA512 d41328ae22eb0768c70567c7759ed9164112c47f4c81ffb3c3b387c0f8fe33b29725d25cd5b8b390c9feca405d9f426cb823ed8ec5b91d7a139ae5de742e9351
- SSDEEP 49152:bs87tFIYKrGSBUsthSxelQwz1w9r+U32mIXzTmCc4iMVWS:k
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot spx04 1568039940 banker evasion persistence stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Turns off Windows Defender SpyNet reporting
  evasion
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2