General
-
Target
7129888721dfbc9cfd6510e96814881ee0ec1c6cbeb31a0a5fb897c8d204067c
-
Size
592KB
-
Sample
240831-l2dybsyajq
-
MD5
87fe1bf89069892c08cfc2dfb4d75f21
-
SHA1
2378535766c7e7ebc0d271ff1526e9c7279fd2ae
-
SHA256
7129888721dfbc9cfd6510e96814881ee0ec1c6cbeb31a0a5fb897c8d204067c
-
SHA512
c95cb68ab8c0a796e4cb673095dc756e2621163fea0f2354ffeb2318eeff65f431694901b1085a4acce5f6c742dd854c74ac8b9e5d233595b4f052fe76908c3d
-
SSDEEP
12288:EYHsr35Zbpivj9B/OMlT9hcdmu9XzoEAEmiBFxzr2FjHkor1OZWAfRfKzJye:QrJZl2mMl69XBmyF9EIoZKhfK9d
Malware Config
Extracted
qakbot
402.363
tr
1633943125
140.82.49.12:443
89.137.52.44:443
24.107.165.50:443
66.216.193.114:443
75.131.217.182:443
41.86.42.158:995
24.119.214.7:443
67.166.233.75:443
105.198.236.99:443
120.151.47.189:443
2.222.167.138:443
41.228.22.180:443
78.105.213.151:995
5.193.125.67:995
41.86.42.158:443
96.57.188.174:2078
120.150.218.241:995
66.177.215.152:0
122.11.220.212:2222
73.52.50.32:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Targets
-
-
Target
43473f86f79b6715cfc717e05e9e6ec308de16dc4772e1f2ae7dc0fb42e27367
-
Size
1.2MB
-
MD5
909f438cd5b77778fa453dff37fb8100
-
SHA1
579bc06371ccfa3d67262f38100a30889f6e69fa
-
SHA256
43473f86f79b6715cfc717e05e9e6ec308de16dc4772e1f2ae7dc0fb42e27367
-
SHA512
89e375da4664d01eb91ab6a1fd58646fcd20e7b638558b74a5377fa196397f9abb1053e8477ae99121dd1b327b648c5cf5b7da5a4dfb8a4f28c6fe177879a30f
-
SSDEEP
24576:ow7BZFodRlyc501VWUMkTjACzDSMPhy5DipHl950JkSr+qk5acKVv8dbF+7:vLt18UMeTzD3pbpr50mSrtkIcKVvu5+7
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Windows security bypass
-
Loads dropped DLL
-