General
-
Target
7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118
-
Size
573KB
-
Sample
240725-tvrvlsthje
-
MD5
7058abeb6f7d4a69c47fd8fa59a0abcf
-
SHA1
64626a76a5f0d8629c67bc1d0e08f09ad0121484
-
SHA256
38e719c1c9a05a97509a8fd8ed2a5b784839f945a211bddc7f7bbd9eb4b36c18
-
SHA512
ba3eb479a00fb46d6bbbfd85bdcf0b55c2b4cdb3b4be9d5b804706b4e7dfd69a7291c4029bad3c40427193caed4b7b3dad18a5772b29abb51fce5dfec63d0206
-
SSDEEP
12288:q87H3sH2k/es9A9tqKsuud0/l0pT7fEztxG9HBMbVNAzirS:qSs7/3Ytq4E3MzO9HoHos
Malware Config
Extracted
qakbot
402.363
obama107
1633078880
140.82.49.12:443
41.250.143.109:995
216.201.162.158:443
86.8.177.143:443
105.198.236.99:443
124.123.42.115:2222
217.17.56.163:443
37.210.152.224:995
190.198.206.189:2222
75.89.195.186:995
78.191.44.76:995
122.11.220.212:2222
68.186.192.69:443
159.2.51.200:2222
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
120.151.47.189:443
47.22.148.6:443
94.200.181.154:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Targets
-
-
Target
7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118
-
Size
573KB
-
MD5
7058abeb6f7d4a69c47fd8fa59a0abcf
-
SHA1
64626a76a5f0d8629c67bc1d0e08f09ad0121484
-
SHA256
38e719c1c9a05a97509a8fd8ed2a5b784839f945a211bddc7f7bbd9eb4b36c18
-
SHA512
ba3eb479a00fb46d6bbbfd85bdcf0b55c2b4cdb3b4be9d5b804706b4e7dfd69a7291c4029bad3c40427193caed4b7b3dad18a5772b29abb51fce5dfec63d0206
-
SSDEEP
12288:q87H3sH2k/es9A9tqKsuud0/l0pT7fEztxG9HBMbVNAzirS:qSs7/3Ytq4E3MzO9HoHos
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Windows security bypass
-
Loads dropped DLL
-