qakbot | 869985182924ca7548289156cb500612a9f171c7e098b04550dbf62ab8f4ebd9

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-17_554f5704a23ec35d348b9fa77092ce53_conti_elex_emotet
Size 500KB
Sample260317-exvxqaev3v
SHA256 869985182924ca7548289156cb500612a9f171c7e098b04550dbf62ab8f4ebd9
MD5 554f5704a23ec35d348b9fa77092ce53
SHA1 1d0b0d77dca66814e7c8976f3c095574a7c4e8ff
SHA512 035c0f869541c3abeecfac6b531309e01fec7cf538e331d28d3a4f8ee35d3a47f3a20c7d3562c657899644501dfb4115b01c85775eefa5a00176aa8996519ab5
SSDEEP 12288:A1PrZnZ+bAbZ0c78+O17e6j4gmoFFyy17xxxfe:A5ZnZ+bE78/1C6j4gmofyMxxfe
TLSH
T1C1B4232BA9666852C41B8CB114EBD4B2DD3DBC250B2ACE7FB1D46C4B9F0034BF525366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

322.742

Botnet

sp34

Campaign

1553090804

Credentials

Protocol
ftp
Host
192.185.5.208
Port
21
Username
[email protected]
Password
NxdkxAp4dUsY

Credentials

Protocol
ftp
Host
162.241.218.118
Port
21
Username
[email protected]
Password
EcOV0DyGVgVN

Credentials

Protocol
ftp
Host
69.89.31.139
Port
21
Username
[email protected]
Password
fcR7OvyLrMW6!

Credentials

Protocol
ftp
Host
169.207.67.14
Port
21
Username
[email protected]
Password
eQyicNLzzqPN

71.210.140.93:995
96.20.84.208:443
69.70.37.246:990
189.155.76.117:443
209.239.4.118:443
69.1.28.14:2222
71.56.132.47:2222
205.200.185.182:2222
68.83.59.107:443
68.147.26.96:443
190.120.196.18:443
70.53.99.56:32101
187.192.41.60:443
50.247.230.33:443
66.222.88.126:995
96.83.78.97:443
69.243.106.9:443
216.158.122.29:2222
99.197.172.236:2078
76.69.238.238:2222
69.12.127.242:443
70.49.35.92:2222
189.140.44.107:443
70.25.63.178:2222
174.89.90.96:2222
50.70.156.210:443
67.197.97.144:443
184.180.157.203:2222
216.221.73.45:990
41.202.79.201:993
24.138.91.215:2222
173.168.105.213:443
216.8.181.157:443
208.107.235.196:443
108.189.84.199:2222
174.48.72.160:443
65.94.97.185:6883
216.221.73.45:2222
71.31.49.181:443
74.68.50.163:443
69.70.37.246:993
75.170.63.3:2222
47.48.236.98:2222
199.36.199.104:443
144.172.181.63:2222
216.221.73.45:993
24.76.123.171:2222
66.171.24.252:443
65.116.179.83:443
70.105.162.74:443
70.183.154.153:995
204.111.80.128:3389
108.50.230.138:443
24.173.61.30:443
192.226.157.108:993
174.88.1.94:2222
96.20.94.194:2222
209.152.79.118:443
200.75.252.82:443
38.92.122.143:995
69.70.37.246:465
104.3.91.20:995
207.178.109.161:443
83.110.108.131:443
173.173.167.129:443
65.94.97.185:2222
179.26.206.164:443
47.180.18.14:443
72.161.250.4:2222
75.187.47.113:443
181.119.30.36:443
2.50.156.213:443
69.70.37.246:995
68.59.209.183:995
70.183.177.22:995
173.188.48.49:995
184.161.177.223:2222
216.213.195.94:443
71.205.168.236:443
74.115.246.21:995
173.17.150.50:443
181.119.30.28:443
190.120.196.18:993
190.120.196.18:50002
190.120.196.18:990
190.120.196.18:1194
181.25.220.194:995
200.3.248.226:2078
108.49.108.127:443
74.63.195.38:443
65.94.97.185:2083
70.183.177.22:61202
64.228.73.64:2222
192.198.85.26:443
201.152.138.82:995
108.55.23.221:443
148.240.66.99:6881
162.237.221.101:443
173.79.220.2:443
76.66.124.54:2222
68.102.37.211:995
209.124.139.34:443
78.94.55.26:50003
69.119.134.83:2222
75.165.175.142:443
65.32.193.195:443
71.197.126.250:443
103.9.226.57:2222
76.183.221.235:443
76.184.248.69:443
38.133.55.60:443
67.53.212.18:2222
72.69.126.5:443
76.168.149.66:443
50.125.73.88:443
108.189.186.188:20
68.238.144.55:443
184.144.204.96:443
66.130.129.10:2222
71.171.94.146:443
74.136.111.248:443
173.20.116.156:443
166.62.206.112:2222
45.50.227.169:995
151.213.48.201:443
170.185.249.43:443
65.94.25.229:2222
65.94.224.232:995
24.201.59.188:2222
72.179.98.51:443
189.135.113.6:443
173.76.203.229:443
187.233.52.47:443
68.14.210.246:22
68.129.77.252:443
184.74.101.234:993
196.62.233.198:995
189.169.4.199:443
70.28.78.228:2222
96.31.250.38:2222
186.29.19.239:2222
174.94.69.136:2222
187.205.221.114:443
189.209.167.173:995
174.89.18.226:443
67.255.123.246:443
190.161.245.225:443
216.221.73.45:465
205.211.204.78:443

Targets

- Target
  2026-03-17_554f5704a23ec35d348b9fa77092ce53_conti_elex_emotet
- Size 500KB
- SHA256 869985182924ca7548289156cb500612a9f171c7e098b04550dbf62ab8f4ebd9
- MD5 554f5704a23ec35d348b9fa77092ce53
- SHA1 1d0b0d77dca66814e7c8976f3c095574a7c4e8ff
- SHA512 035c0f869541c3abeecfac6b531309e01fec7cf538e331d28d3a4f8ee35d3a47f3a20c7d3562c657899644501dfb4115b01c85775eefa5a00176aa8996519ab5
- SSDEEP 12288:A1PrZnZ+bAbZ0c78+O17e6j4gmoFFyy17xxxfe:A5ZnZ+bE78/1C6j4gmofyMxxfe
- TLSH
  T1C1B4232BA9666852C41B8CB114EBD4B2DD3DBC250B2ACE7FB1D46C4B9F0034BF525366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker sp34 1553090804 discovery qakbot stealer trojan
- Qakbot family
  qakbot
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot family

Qakbot/Qbot

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2