General

  • Target

    50ab522d9a735c6cbc399779ff3e73843cd00cfb15de7b3c1e85f8cf251f74fa

  • Size

    5.9MB

  • Sample

    240901-12jadatajr

  • MD5

    5ed4deab615b0465c4c8cdc120ac7151

  • SHA1

    db99625347308b347f9a8cf95563bcdd61bd0b8d

  • SHA256

    50ab522d9a735c6cbc399779ff3e73843cd00cfb15de7b3c1e85f8cf251f74fa

  • SHA512

    4540b9e226ac8ebc7ca5f90e759625cb66939912141ddfa568b4094af981150e8274c9299431cb6164e07ec004c2379fce4b8e50636ef73b427237acfc5d3a41

  • SSDEEP

    6144:HN4thSUHz9HRg1c96R7b3/dyTl8W2p7/j1qBl9scLGUNhN:HYh3Hz9HeTZzdwl8W2ZR6aU3N

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc002

Campaign

1599751744

C2

73.216.60.90:2222

71.74.12.34:443

184.98.103.204:995

71.84.5.114:995

108.190.151.108:2222

76.170.77.99:995

95.77.223.148:443

85.121.42.12:995

72.209.191.27:443

166.62.180.194:2078

189.157.207.155:995

108.185.113.12:443

72.204.242.138:32102

216.163.4.136:443

95.76.109.181:443

108.31.15.10:995

188.25.162.27:443

76.111.128.194:443

209.182.122.217:443

66.215.32.224:443

Targets

    • Target

      50ab522d9a735c6cbc399779ff3e73843cd00cfb15de7b3c1e85f8cf251f74fa

    • Size

      5.9MB

    • MD5

      5ed4deab615b0465c4c8cdc120ac7151

    • SHA1

      db99625347308b347f9a8cf95563bcdd61bd0b8d

    • SHA256

      50ab522d9a735c6cbc399779ff3e73843cd00cfb15de7b3c1e85f8cf251f74fa

    • SHA512

      4540b9e226ac8ebc7ca5f90e759625cb66939912141ddfa568b4094af981150e8274c9299431cb6164e07ec004c2379fce4b8e50636ef73b427237acfc5d3a41

    • SSDEEP

      6144:HN4thSUHz9HRg1c96R7b3/dyTl8W2p7/j1qBl9scLGUNhN:HYh3Hz9HeTZzdwl8W2ZR6aU3N

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks