General

  • Target

    ed08896d4a817db3e5a8762523009f60N.exe

  • Size

    5.7MB

  • Sample

    240904-nqmr7syhjk

  • MD5

    ed08896d4a817db3e5a8762523009f60

  • SHA1

    8533d8147b9b977f896b6d00cd8d40d3da47286c

  • SHA256

    e26f731e7ed78d2e5895df2165608f4457e2cfe9d81c3a5016d05dfde906cbd5

  • SHA512

    a1622abcbc08193b29400e4ec2540b78fc526862f8cbb14d8367cfa9c410febae9453f1d685d9921b0c79080a4e840297836b5d218d3f7993e41c5cd6735a68f

  • SSDEEP

    6144:24thSUHz9HRg1c5Fm0Dq7VTu0Cdvm2MU3Iv7HCuqBl9scWBJy:1h3Hz9HeWFJDmV61AXuu6D

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc001

Campaign

1599561498

C2

166.62.180.194:2078

99.240.226.2:443

95.77.144.238:443

85.122.141.42:995

31.53.49.169:2222

201.216.216.245:443

209.59.87.147:443

85.186.122.190:443

45.32.155.12:443

178.193.38.188:2222

89.137.211.72:443

66.215.32.224:443

199.247.22.145:443

71.84.5.114:995

216.201.162.158:443

47.146.32.175:443

75.81.25.223:443

178.222.21.87:995

24.234.86.201:995

68.33.206.204:443

Targets

    • Target

      ed08896d4a817db3e5a8762523009f60N.exe

    • Size

      5.7MB

    • MD5

      ed08896d4a817db3e5a8762523009f60

    • SHA1

      8533d8147b9b977f896b6d00cd8d40d3da47286c

    • SHA256

      e26f731e7ed78d2e5895df2165608f4457e2cfe9d81c3a5016d05dfde906cbd5

    • SHA512

      a1622abcbc08193b29400e4ec2540b78fc526862f8cbb14d8367cfa9c410febae9453f1d685d9921b0c79080a4e840297836b5d218d3f7993e41c5cd6735a68f

    • SSDEEP

      6144:24thSUHz9HRg1c5Fm0Dq7VTu0Cdvm2MU3Iv7HCuqBl9scWBJy:1h3Hz9HeWFJDmV61AXuu6D

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks