General
-
Target
274113e269927f9d0a9349bc2f7f2c5b7c2a8e5f32768945338dd563ca9555c9
-
Size
302KB
-
Sample
241009-x265nawfld
-
MD5
5eaf615e8011605625ebb5a1cfb46aff
-
SHA1
50e3c74870352b6b499b443674a7808d2a115dcf
-
SHA256
274113e269927f9d0a9349bc2f7f2c5b7c2a8e5f32768945338dd563ca9555c9
-
SHA512
1f6bb75ffc00b37d332e28b3566396b9ab6cbd2efed061b9f5e6d26db048b398bc5218eab917a05f05b4fabc8faf415f349f5be39c8a30382a8aff7375ead2ce
-
SSDEEP
6144:EKMxrqxH6cd1b3QGLwUuxOd4RFxXGjjMvVCj/Go5NR:RHrdpjq4GFxXGHMvVCrdfR
Malware Config
Extracted
qakbot
325.42
notset
1596817234
Protocol: ftp- Host:
192.185.5.208 - Port:
21 - Username:
[email protected] - Password:
NxdkxAp4dUsY
Protocol: ftp- Host:
162.241.218.118 - Port:
21 - Username:
[email protected] - Password:
EcOV0DyGVgVN
Protocol: ftp- Host:
69.89.31.139 - Port:
21 - Username:
[email protected] - Password:
fcR7OvyLrMW6!
Protocol: ftp- Host:
169.207.67.14 - Port:
21 - Username:
[email protected] - Password:
eQyicNLzzqPN
47.44.217.98:443
86.97.146.204:2222
65.60.228.130:443
216.201.162.158:443
94.59.24.79:995
108.46.145.30:443
24.139.132.70:443
47.206.174.82:443
188.52.106.206:20
72.204.242.138:6881
173.173.72.199:443
71.163.224.206:443
63.155.9.141:995
100.34.195.237:443
47.39.177.171:2222
96.20.108.17:2222
115.21.224.117:443
70.164.39.91:443
45.47.65.191:443
207.155.107.111:443
Targets
-
-
Target
274113e269927f9d0a9349bc2f7f2c5b7c2a8e5f32768945338dd563ca9555c9
-
Size
302KB
-
MD5
5eaf615e8011605625ebb5a1cfb46aff
-
SHA1
50e3c74870352b6b499b443674a7808d2a115dcf
-
SHA256
274113e269927f9d0a9349bc2f7f2c5b7c2a8e5f32768945338dd563ca9555c9
-
SHA512
1f6bb75ffc00b37d332e28b3566396b9ab6cbd2efed061b9f5e6d26db048b398bc5218eab917a05f05b4fabc8faf415f349f5be39c8a30382a8aff7375ead2ce
-
SSDEEP
6144:EKMxrqxH6cd1b3QGLwUuxOd4RFxXGjjMvVCj/Go5NR:RHrdpjq4GFxXGHMvVCrdfR
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-