General

  • Target

    7d280a03897599a07bfa2e4890719dd126bcd3d6cdaa8fa6c5414e24b40b3cb0

  • Size

    5.9MB

  • Sample

    240902-ad4cjawbjp

  • MD5

    adb398d7a0bc8f4fd3b2db5f81a50cb3

  • SHA1

    50f60e81818bf58e4f8fd1e175a1528c242e15c5

  • SHA256

    7d280a03897599a07bfa2e4890719dd126bcd3d6cdaa8fa6c5414e24b40b3cb0

  • SHA512

    027e2ae9de2dfd0d45296ebc714d2ba903798d110e1676e102cb541dcc68fc2e68eaa93fa0e7adadf9c8c1e19e6f26cf3684e8c502985959bf3b8d6847c7522f

  • SSDEEP

    6144:HZ4thSUHz9HRg1c96R7b3/dyTl8W2p7/j1qBl9scLGUNhN:Hsh3Hz9HeTZzdwl8W2ZR6aU3N

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc002

Campaign

1599751744

C2

73.216.60.90:2222

71.74.12.34:443

184.98.103.204:995

71.84.5.114:995

108.190.151.108:2222

76.170.77.99:995

95.77.223.148:443

85.121.42.12:995

72.209.191.27:443

166.62.180.194:2078

189.157.207.155:995

108.185.113.12:443

72.204.242.138:32102

216.163.4.136:443

95.76.109.181:443

108.31.15.10:995

188.25.162.27:443

76.111.128.194:443

209.182.122.217:443

66.215.32.224:443

Targets

    • Target

      7d280a03897599a07bfa2e4890719dd126bcd3d6cdaa8fa6c5414e24b40b3cb0

    • Size

      5.9MB

    • MD5

      adb398d7a0bc8f4fd3b2db5f81a50cb3

    • SHA1

      50f60e81818bf58e4f8fd1e175a1528c242e15c5

    • SHA256

      7d280a03897599a07bfa2e4890719dd126bcd3d6cdaa8fa6c5414e24b40b3cb0

    • SHA512

      027e2ae9de2dfd0d45296ebc714d2ba903798d110e1676e102cb541dcc68fc2e68eaa93fa0e7adadf9c8c1e19e6f26cf3684e8c502985959bf3b8d6847c7522f

    • SSDEEP

      6144:HZ4thSUHz9HRg1c96R7b3/dyTl8W2p7/j1qBl9scLGUNhN:Hsh3Hz9HeTZzdwl8W2ZR6aU3N

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks