General
-
Target
41ffecc1aa0e59d0e22bcf44c0f66a12_JaffaCakes118
-
Size
573KB
-
Sample
240713-re6ygswbpb
-
MD5
41ffecc1aa0e59d0e22bcf44c0f66a12
-
SHA1
232a64e4ff7a42769028c527b738a1b80e3e8ff6
-
SHA256
ef64f344af3c324ac8f38b985abb0a794b27c97863b40ad597dfbb9217a2a115
-
SHA512
d2dca18b0de89acf329669f635f39e1ebaca15af1d63d3910506e3186324ce67ff211dc674dce095e96566a00f5b3eb90ba2e3a2b8999fb07be42fc2cf08449b
-
SSDEEP
12288:R87H3sH2k/eh9A9tqKsuud0jl0pT7fEztxG9HBMbVNAjirS:RSs7/uYtqkE3MzO9HoHos
Malware Config
Extracted
qakbot
402.363
obama107
1633078880
140.82.49.12:443
41.250.143.109:995
216.201.162.158:443
86.8.177.143:443
105.198.236.99:443
124.123.42.115:2222
217.17.56.163:443
37.210.152.224:995
190.198.206.189:2222
75.89.195.186:995
78.191.44.76:995
122.11.220.212:2222
68.186.192.69:443
159.2.51.200:2222
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
120.151.47.189:443
47.22.148.6:443
94.200.181.154:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Targets
-
-
Target
41ffecc1aa0e59d0e22bcf44c0f66a12_JaffaCakes118
-
Size
573KB
-
MD5
41ffecc1aa0e59d0e22bcf44c0f66a12
-
SHA1
232a64e4ff7a42769028c527b738a1b80e3e8ff6
-
SHA256
ef64f344af3c324ac8f38b985abb0a794b27c97863b40ad597dfbb9217a2a115
-
SHA512
d2dca18b0de89acf329669f635f39e1ebaca15af1d63d3910506e3186324ce67ff211dc674dce095e96566a00f5b3eb90ba2e3a2b8999fb07be42fc2cf08449b
-
SSDEEP
12288:R87H3sH2k/eh9A9tqKsuud0jl0pT7fEztxG9HBMbVNAjirS:RSs7/uYtqkE3MzO9HoHos
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Windows security bypass
-
Loads dropped DLL
-