qakbot | d4f7a0b2f29812223444cbce4684c12891962616708bbcc7a684a0efa510bdb4

Resubmissions

23/05/2024, 04:24

240523-e1jzmadg7710

23/05/2024, 04:18

240523-ew76nadf2w10

Sharing

Copy URL Twitter E-mail

General

Target
vegetated.dat
Size 354KB
Sample240523-e1jzmadg77
SHA256 d4f7a0b2f29812223444cbce4684c12891962616708bbcc7a684a0efa510bdb4
MD5 95b1ae44716fb74b3ce589d7e1b53c3a
SHA1 d322925f126c486cd2b5112057e4dd3e9692b7be
SHA512 dcd2aa426895a12e0e0a40a8e034c4b72161b8c929efae1d296ca29307e906c4a8df309b6ddbc234f3f63e0ac288641a3214895646d9d5c98ac9e69f1c5dd3d2
SSDEEP 6144:ENsacLpop/C9lIbtBMHkqmO+pefWoAw6hjSy/AACs98K/f+ZuDXKK8bTcTCaULa4:gs/tMrbQHt+ps4w6RcA3/2oXmbTdaUe4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

404.14

Botnet

obama220

Campaign

1667373670

174.0.224.214:443
70.60.142.214:2222
136.232.184.134:995
67.87.214.7:443
174.104.184.149:443
64.207.237.118:443
144.202.15.58:443
74.33.84.227:443
175.205.2.54:443
174.77.209.5:443
45.49.137.80:443
74.92.243.113:995
76.68.34.167:2222
49.175.72.56:443
190.24.45.24:995
50.68.204.71:443
179.100.109.130:32101
70.64.77.115:443
109.151.171.116:2222
91.138.17.202:443
182.66.197.35:443
193.3.19.137:443
41.44.11.227:995
154.247.31.51:993
50.68.204.71:993
190.207.121.156:2222
157.231.42.190:443
66.131.25.6:443
73.165.119.20:443
187.199.171.252:32103
154.247.31.51:995
154.247.31.51:32103
50.68.204.71:995
58.162.223.233:443
101.109.57.236:995
58.247.115.126:995
84.35.26.14:995
172.219.147.156:3389
102.158.228.70:995
74.92.243.113:50000
157.231.42.190:995
68.146.18.15:443
216.82.134.218:443
181.164.194.228:443
190.18.236.175:443
200.233.108.153:995
50.37.149.215:443
186.64.67.44:443
71.199.168.185:443
94.49.5.116:443
217.39.57.121:443
108.44.207.232:443
181.56.171.3:995
136.244.25.165:443
173.32.181.236:443
186.73.140.43:443
97.119.214.233:443
190.74.248.136:443
50.86.217.209:443
73.88.173.113:443
86.173.19.76:443
45.62.78.1:443
201.245.250.192:995
206.1.168.96:443
78.162.245.96:443
62.35.100.38:443
181.55.106.237:443
72.11.161.70:443
190.134.202.68:443
24.69.87.61:443
123.3.240.16:995
204.210.210.7:443
78.165.146.61:443
142.161.120.116:2222
70.51.139.148:2222
68.103.242.126:995
174.4.112.228:443
88.171.156.150:50000
196.89.174.35:443
74.59.46.149:2222
76.125.91.160:443
62.46.231.64:443
24.253.221.86:443
109.154.46.73:443
142.118.239.135:2222
65.20.175.208:443
78.161.38.242:443
205.161.22.189:443
72.88.245.71:443
99.253.103.210:443
90.165.109.4:2222
151.213.183.141:995
190.75.37.178:2222
149.126.159.224:443
85.241.180.94:443
78.202.9.97:443
92.26.102.243:995
156.220.4.75:993
102.159.56.88:443
152.170.17.136:443
41.99.229.52:443
102.158.184.73:443
75.84.234.68:443
190.203.11.218:443
178.197.228.37:2222
64.127.146.153:443
47.6.225.229:443
51.219.234.104:2222
199.68.108.190:443
92.239.81.124:443
113.169.59.46:443
138.207.238.47:443
58.186.75.42:443
115.70.203.2:995
190.207.196.66:2222
206.1.230.114:2087
94.15.58.251:443
190.78.69.192:993
23.233.254.195:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

- Target
  vegetated.dat
- Size 354KB
- SHA256 d4f7a0b2f29812223444cbce4684c12891962616708bbcc7a684a0efa510bdb4
- MD5 95b1ae44716fb74b3ce589d7e1b53c3a
- SHA1 d322925f126c486cd2b5112057e4dd3e9692b7be
- SHA512 dcd2aa426895a12e0e0a40a8e034c4b72161b8c929efae1d296ca29307e906c4a8df309b6ddbc234f3f63e0ac288641a3214895646d9d5c98ac9e69f1c5dd3d2
- SSDEEP 6144:ENsacLpop/C9lIbtBMHkqmO+pefWoAw6hjSy/AACs98K/f+ZuDXKK8bTcTCaULa4:gs/tMrbQHt+ps4w6RcA3/2oXmbTdaUe4
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot obama220 1667373670 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1