General

  • Target

    eada05f5283c7b75ccfef4585c5a3300N.exe

  • Size

    5.9MB

  • Sample

    240905-tjh4bsvejh

  • MD5

    eada05f5283c7b75ccfef4585c5a3300

  • SHA1

    486c0c0ed4d1f3907686404b18423b20eeb77077

  • SHA256

    ae5123c6a2ea0613d78f6971748d55e54c331420f37fa7a4797bee1af0f59a74

  • SHA512

    c047613de514136583fb7b18d48d9d398932effecc023a9684497e2f9fdf0dd6e0d2f1e1f9afc6b3025bde4f6605aebe976a25eaea6814038724c4e9acbafcae

  • SSDEEP

    6144:H04thSUHz9HRg1c96R7b3/dyTl8W2p7/j1qBl9scLGUNhN:HTh3Hz9HeTZzdwl8W2ZR6aU3N

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc002

Campaign

1599751744

C2

73.216.60.90:2222

71.74.12.34:443

184.98.103.204:995

71.84.5.114:995

108.190.151.108:2222

76.170.77.99:995

95.77.223.148:443

85.121.42.12:995

72.209.191.27:443

166.62.180.194:2078

189.157.207.155:995

108.185.113.12:443

72.204.242.138:32102

216.163.4.136:443

95.76.109.181:443

108.31.15.10:995

188.25.162.27:443

76.111.128.194:443

209.182.122.217:443

66.215.32.224:443

Targets

    • Target

      eada05f5283c7b75ccfef4585c5a3300N.exe

    • Size

      5.9MB

    • MD5

      eada05f5283c7b75ccfef4585c5a3300

    • SHA1

      486c0c0ed4d1f3907686404b18423b20eeb77077

    • SHA256

      ae5123c6a2ea0613d78f6971748d55e54c331420f37fa7a4797bee1af0f59a74

    • SHA512

      c047613de514136583fb7b18d48d9d398932effecc023a9684497e2f9fdf0dd6e0d2f1e1f9afc6b3025bde4f6605aebe976a25eaea6814038724c4e9acbafcae

    • SSDEEP

      6144:H04thSUHz9HRg1c96R7b3/dyTl8W2p7/j1qBl9scLGUNhN:HTh3Hz9HeTZzdwl8W2ZR6aU3N

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks