General

  • Target

    138fa977f6f1de4e92e1b1ad04751c6a48fbf6dafe1eea0e59668425c3f03fb5N.exe

  • Size

    1.2MB

  • Sample

    250116-3y685swlbj

  • MD5

    dfde7b01153135be4548aa7b9b472370

  • SHA1

    ff19730ac78ed3c843305da3537d5f36e322fcc0

  • SHA256

    138fa977f6f1de4e92e1b1ad04751c6a48fbf6dafe1eea0e59668425c3f03fb5

  • SHA512

    2762cdb718c30b122c00af81da7625d1141de95d8c1d15a7058e94b8866be8be3c99cbe27b1d7efcc0798eccd01c1970961a388f6b3b7352dc44b39768b46c54

  • SSDEEP

    6144:JsHHUPFY76DEoS5rYU/LPlbuo2YILNkFVZ5VfUllOp2n2FxHot1WL+Lwb5tJRt:fs6AoS5EU/Lp56kBgXOInmNouL+Lwb5H

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc008

Campaign

1600855273

C2

77.30.99.99:995

122.165.181.76:995

72.28.255.159:995

108.46.145.30:443

45.77.193.83:443

207.246.75.201:443

108.5.34.248:443

203.198.96.200:443

188.52.107.171:995

184.96.141.112:993

74.129.24.163:443

24.218.181.15:443

197.57.51.59:443

217.162.149.212:443

24.27.82.216:2222

78.97.3.6:443

96.41.93.96:443

197.210.96.222:995

45.32.154.10:443

199.247.16.80:443

Targets

    • Target

      138fa977f6f1de4e92e1b1ad04751c6a48fbf6dafe1eea0e59668425c3f03fb5N.exe

    • Size

      1.2MB

    • MD5

      dfde7b01153135be4548aa7b9b472370

    • SHA1

      ff19730ac78ed3c843305da3537d5f36e322fcc0

    • SHA256

      138fa977f6f1de4e92e1b1ad04751c6a48fbf6dafe1eea0e59668425c3f03fb5

    • SHA512

      2762cdb718c30b122c00af81da7625d1141de95d8c1d15a7058e94b8866be8be3c99cbe27b1d7efcc0798eccd01c1970961a388f6b3b7352dc44b39768b46c54

    • SSDEEP

      6144:JsHHUPFY76DEoS5rYU/LPlbuo2YILNkFVZ5VfUllOp2n2FxHot1WL+Lwb5tJRt:fs6AoS5EU/Lp56kBgXOInmNouL+Lwb5H

    • Qakbot family

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks