qakbot | e7d7fc4f9f320ae74f296278beadf5a335ec7f4c71bc2f3fdac2ba0069376a0c

Sharing

Copy URL Twitter E-mail

General

Target
ca5c21f1f6ec2720f105d5b6e4903200N.exe
Size 5.9MB
Sample240903-ydkr7avepl
SHA256 e7d7fc4f9f320ae74f296278beadf5a335ec7f4c71bc2f3fdac2ba0069376a0c
MD5 ca5c21f1f6ec2720f105d5b6e4903200
SHA1 19e824ce163e10c4fe36384a51a68fb8524a7418
SHA512 6360cc9876fcb8434ad7271925a918bac6a9ff0d6087ac9653642311dffe70d604218b2ec37200a8101f4860f11b5753ce1b337a106ab63bdaca9681f4f9561c
SSDEEP 6144:HX4thSUHz9HRg1c96R7b3/dyTl8W2p7/j1qBl9scLGUNhN:Hqh3Hz9HeTZzdwl8W2ZR6aU3N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc002

Campaign

1599751744

73.216.60.90:2222
71.74.12.34:443
184.98.103.204:995
71.84.5.114:995
108.190.151.108:2222
76.170.77.99:995
95.77.223.148:443
85.121.42.12:995
72.209.191.27:443
166.62.180.194:2078
189.157.207.155:995
108.185.113.12:443
72.204.242.138:32102
216.163.4.136:443
95.76.109.181:443
108.31.15.10:995
188.25.162.27:443
76.111.128.194:443
209.182.122.217:443
66.215.32.224:443
74.195.88.59:995
35.134.202.234:443
69.47.239.10:443
108.34.180.25:443
77.159.149.74:443
50.29.166.232:995
207.255.161.8:465
65.131.28.224:995
45.32.155.12:443
96.18.240.158:443
216.201.162.158:443
151.73.125.102:443
207.255.161.8:993
200.75.136.78:443
66.57.216.53:993
71.126.139.251:443
96.37.113.36:993
71.187.170.235:443
69.167.206.238:50001
68.174.15.223:443
207.255.161.8:32100
47.201.1.210:443
68.190.152.98:443
189.210.114.157:443
205.178.7.90:443
68.225.56.31:443
24.71.28.247:443
141.193.83.107:443
50.244.112.10:995
72.204.242.138:465
108.191.28.158:443
72.36.59.46:2222
75.136.26.147:443
68.134.181.98:443
208.82.44.203:443
47.146.32.175:443
69.11.247.242:443
75.81.25.223:443
66.31.96.223:443
217.162.149.212:443
96.247.177.63:443
50.232.172.114:443
68.116.193.239:443
184.180.157.203:2222
73.32.115.251:443
2.91.73.118:995
98.26.50.62:995
79.118.24.67:443
37.210.186.213:61201
199.247.22.145:443
2.91.125.145:995
213.120.109.73:2222
72.179.13.59:443
24.37.178.158:443
50.104.68.223:443
190.207.11.41:2078
67.209.195.198:443
207.255.161.8:995
209.137.209.163:995
93.113.177.152:443
189.140.48.54:443
86.174.116.60:2222
216.146.110.68:443
50.244.112.106:443
47.28.131.209:443
181.133.218.233:443
80.14.209.42:2222
75.170.94.218:443
207.255.18.67:443
75.137.239.211:443
45.77.193.83:443
72.204.242.138:990
45.32.154.10:443
95.179.247.224:443
199.247.16.80:443
207.246.75.201:443
73.228.1.246:443
86.163.174.7:2222
98.16.204.189:995
5.13.70.3:443
75.136.40.155:443
67.149.82.94:8443
73.227.232.166:443
99.240.226.2:443
187.201.250.59:995
151.205.102.42:443
85.204.189.105:443
200.124.231.21:443
172.87.134.226:443
72.240.200.181:2222
71.182.142.63:443
185.246.9.69:995
5.193.181.221:2078
178.222.21.87:995
85.122.141.42:995
74.102.76.128:443
74.75.216.202:443
72.190.101.70:443
189.160.236.226:443
98.121.187.78:443
189.231.196.236:443
47.146.169.85:443
74.75.237.11:443
175.211.225.118:443
72.204.242.138:20
86.97.162.2:443
80.195.103.146:2222
50.247.230.33:995
41.228.198.27:443
141.158.47.123:443
83.103.182.50:443
47.44.217.98:443
207.255.161.8:443
207.255.161.8:2087
207.255.161.8:32103
67.8.103.21:443
67.6.51.74:443
108.46.145.30:443
71.50.215.14:0
72.204.242.138:53
70.123.92.175:2222
192.40.225.168:443
80.240.26.178:443
95.77.144.238:443
94.59.227.197:995
2.50.59.219:443
96.41.93.96:443
172.78.30.215:443
190.85.91.154:443
36.230.79.87:443

Targets

- Target
  ca5c21f1f6ec2720f105d5b6e4903200N.exe
- Size 5.9MB
- SHA256 e7d7fc4f9f320ae74f296278beadf5a335ec7f4c71bc2f3fdac2ba0069376a0c
- MD5 ca5c21f1f6ec2720f105d5b6e4903200
- SHA1 19e824ce163e10c4fe36384a51a68fb8524a7418
- SHA512 6360cc9876fcb8434ad7271925a918bac6a9ff0d6087ac9653642311dffe70d604218b2ec37200a8101f4860f11b5753ce1b337a106ab63bdaca9681f4f9561c
- SSDEEP 6144:HX4thSUHz9HRg1c96R7b3/dyTl8W2p7/j1qBl9scLGUNhN:Hqh3Hz9HeTZzdwl8W2ZR6aU3N
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qakbot abc002 1599751744 banker discovery stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2