qakbot | ce80bb3f99f496156c06ec2a2927497279e6a3b52460c5951ae879d911a4bde6

Sharing

Copy URL Twitter E-mail

General

Target
81f39b11a731fdcb71fdadea1dd8a54f_JaffaCakes118
Size 988KB
Sample240801-183mlaygpr
SHA256 ce80bb3f99f496156c06ec2a2927497279e6a3b52460c5951ae879d911a4bde6
MD5 81f39b11a731fdcb71fdadea1dd8a54f
SHA1 79c78ab1ed613be1bb3214283039d89466396380
SHA512 d1e0aa4b74f921de3f84884f23c7a4fb4c022792212e70773960229bc9a07fa14d44d9ad4acbc8bd7e0c3bf3bd44e5ef1b88660ada49369f50f579622f5bd79e
SSDEEP 24576:QT+X9Up0s/k/PZ+0gJwNYvfLViPRyqiz5nU76jP/qGO:SeUCGJwNqh8Ryq0Ee/hO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

323.91

Botnet

spx16

Campaign

1569917382

71.93.60.90:443
113.77.242.83:443
203.192.232.72:443
98.186.90.192:995
172.78.47.99:443
72.213.98.233:443
76.184.141.236:443
12.5.37.3:443
96.20.238.2:2087
68.225.250.136:443
75.110.90.155:443
96.20.238.2:2078
96.22.239.27:2222
123.252.128.47:443
70.167.72.28:443
2.50.170.151:443
2.177.115.198:443
96.28.229.218:443
67.10.18.112:995
70.183.155.118:80
70.169.2.228:443
72.16.212.107:995
181.90.124.162:443
100.4.185.8:443
199.126.92.231:995
67.77.162.13:443
173.247.186.90:443
96.20.238.2:2083
47.23.101.26:465
207.179.194.91:443
70.183.177.71:443
173.247.186.90:995
5.89.115.73:2222
47.146.173.204:443
76.116.128.81:443
75.131.72.82:443
200.104.249.67:443
47.153.115.154:443
104.34.122.18:443
108.160.123.244:443
24.31.249.123:443
107.12.140.181:443
104.3.91.20:995
74.194.4.181:443
181.126.80.118:443
67.214.8.102:443
72.29.181.77:2083
207.162.184.228:443
72.142.106.198:465
76.80.66.226:443
67.246.16.250:995
68.83.59.107:443
96.20.238.2:61201
47.144.93.71:443
96.20.238.2:2222
81.149.189.61:8443
47.23.101.26:993
72.240.155.78:443
99.241.22.53:443
206.51.202.106:50002
116.58.100.130:995
66.214.75.176:443
108.184.57.213:8443
67.10.18.112:993
173.178.129.3:443
217.162.149.212:443
71.84.5.114:995
67.87.38.242:2222
77.30.11.142:443
75.165.181.122:443
186.47.208.238:50000
185.219.83.73:443
203.161.179.114:2222
75.131.239.76:443
110.12.60.117:443
71.30.56.170:443
181.197.195.138:995
173.161.148.169:995
80.14.209.42:2222
100.38.177.146:995
190.144.81.158:995
98.236.87.243:995
137.119.216.25:443
75.110.250.89:443
47.153.115.154:995
70.166.97.7:465
162.244.224.166:443
70.163.224.7:443
76.6.64.52:995
24.32.119.146:443
24.30.69.9:443
173.172.205.216:443
173.247.186.90:2083
24.184.6.58:2222
168.245.228.71:443
73.202.121.222:443
108.45.183.59:443
64.19.74.29:995
71.84.5.114:443
96.59.11.86:443
173.247.186.90:993
73.37.61.237:443
197.89.140.185:995
184.180.157.203:2222
50.46.139.209:443
68.174.15.223:443
50.247.230.33:443
73.179.178.78:443
192.24.181.185:443
76.181.237.223:443
71.105.197.98:443
206.255.212.179:443
96.228.21.246:443
184.191.62.78:443
73.226.220.56:443
65.116.179.83:443
104.32.185.213:2222
23.240.185.215:443
68.238.56.27:443
166.62.180.194:2078
111.125.70.30:2222
173.247.186.90:6883
75.69.3.12:443
190.120.196.18:443
12.176.32.146:443
173.247.186.90:8443
174.16.255.191:993
65.30.12.240:995
173.22.120.11:2222
71.77.231.251:443
162.244.225.30:443
75.70.218.193:443
137.25.72.175:443
99.228.242.183:995
174.48.72.160:443
50.246.229.50:443
24.44.253.222:443
5.150.100.252:443
73.60.156.223:443
187.206.118.246:995
24.180.7.155:443
47.180.66.10:995
174.60.88.130:995
108.26.201.34:443
74.134.4.236:443
71.197.126.250:443
173.233.182.249:443
173.172.56.79:443
98.181.182.13:2078

Targets

- Target
  CK_19617_9585862810069.vbs
- Size 2.5MB
- SHA256 5b0e3944fec83a8d868a84247ed664764ba213a1c22bf7618240a4c995fc6c74
- MD5 8d658117310b8089242c9e9c572dde73
- SHA1 6403b791f6d07b13900fdc2a921feb19fe3daf29
- SHA512 2e62354b9259629b94978cca95ffd8c3d1e4fe5fea79a7efe5c14fa378e8f7ae8c630d9805611d9bb71aa40433768a88b018a13040fbdd289c395fd59d3fd77f
- SSDEEP 24576:NC4YmLjKcMR0sjeZavuZ+Ijp6rc6/zo1gcHpXZtJ1f/IiF5dvldb6gyCUrN7YFc+:F5Q/bfdhJFC
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot spx16 1569917382 banker discovery evasion persistence stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Turns off Windows Defender SpyNet reporting
  evasion
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2