qakbot | e29be826cf6f18408c98c5bab165d00192e92efdee576de6bce3e9f216295568

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-25_f66d12a9cd213be8f3368592142b0249_amadey_elex_rhadamanthys_smoke-loader_stop
Size 711KB
Sample260425-jnammsbv3t
SHA256 e29be826cf6f18408c98c5bab165d00192e92efdee576de6bce3e9f216295568
MD5 f66d12a9cd213be8f3368592142b0249
SHA1 61285a5196882bb69282ec0414865c992a28144c
SHA512 097ad98ef7447b8dc44daadc291616cf2ce4335dd496185f953a58ec66ecd7683cea880c90829885209a7d1f1960e3f1bce60d0c828faf63e55cc0e6095fe603
SSDEEP 12288:xIcPlwVdyqNxNKGUhUuW5DVHbF9B5ee5FRd5aixWcl5fMz2:xIcPidShqRbF0MVaixWyg
TLSH
T156F4AC91A7FC262CF5F37F366D7862254E3BBC96AC79DA4D12200D495CB2B4099E4323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

323.91

Campaign

1574838677

Credentials

Protocol
ftp
Host
192.185.5.208
Port
21
Username
[email protected]
Password
NxdkxAp4dUsY

Credentials

Protocol
ftp
Host
162.241.218.118
Port
21
Username
[email protected]
Password
EcOV0DyGVgVN

Credentials

Protocol
ftp
Host
69.89.31.139
Port
21
Username
[email protected]
Password
fcR7OvyLrMW6!

Credentials

Protocol
ftp
Host
169.207.67.14
Port
21
Username
[email protected]
Password
eQyicNLzzqPN

74.71.216.1:443
2.50.157.249:443
32.208.1.239:8443
71.30.56.170:443
172.78.87.180:995
71.77.231.251:443
206.51.202.106:50002
70.164.39.91:443
173.61.231.209:443
47.23.101.26:465
166.62.180.194:2078
162.244.225.30:443
108.160.123.244:443
68.238.56.27:443
72.16.212.107:465
24.184.6.58:2222
47.153.115.154:995
162.244.224.166:443
73.226.220.56:443
98.30.99.15:443
173.178.129.3:990
68.238.144.55:443
75.131.72.82:995
196.194.74.241:443
201.188.122.252:443
49.191.132.118:443
107.184.252.92:443
104.32.185.213:2222
68.174.15.223:443
47.137.243.80:443
104.34.103.46:2222
172.242.9.118:995
50.246.229.50:443
47.202.98.230:443
173.178.129.3:443
70.124.29.226:443
196.194.74.241:2222
71.90.241.69:443
188.209.65.96:443
116.72.210.138:2222
201.243.239.2:443
172.251.77.230:443
75.70.218.193:443
173.3.132.17:995
75.175.209.163:995
181.126.80.118:443
73.232.165.200:995
23.240.185.215:443
201.152.164.172:995
174.48.72.160:443
72.208.184.15:443
103.120.189.222:443
24.49.58.134:443
75.130.117.134:443
68.83.59.107:443
107.12.131.249:443
47.146.169.85:443
186.47.208.238:50000
12.176.32.146:443
67.87.38.242:2222
173.22.120.11:2222
74.194.4.181:443
67.246.180.90:443
24.201.68.105:2078
24.111.196.195:443
62.47.252.79:995
64.19.74.29:995
104.3.91.20:995
73.104.218.229:0
75.81.25.223:995
67.190.189.217:443
98.148.177.77:443
24.202.42.48:2222
173.172.205.216:443
75.131.239.76:995
67.246.16.250:995
73.200.219.143:443
71.226.140.73:443
68.225.250.136:443
65.30.12.240:443
181.197.195.138:995
97.122.229.88:993
197.82.208.143:995
205.250.79.62:443
108.227.161.27:443
66.214.75.176:443
75.166.74.158:443
83.110.155.5:443
97.84.226.90:443
173.172.205.216:995
75.110.250.89:443
72.190.101.70:443
12.5.37.3:995
68.49.120.179:443
75.182.214.87:443
24.30.71.200:443
100.4.185.8:443
50.247.230.33:995
184.74.101.234:995
76.31.62.34:443
173.247.186.90:2087
47.214.144.253:443
32.208.1.239:443
104.34.122.18:443
12.5.37.3:443
116.58.100.130:443
75.142.59.167:443
72.183.255.148:443
203.83.20.209:995
80.14.209.42:2222
96.35.170.82:2222
184.180.157.203:2222
170.10.78.48:443
71.84.5.114:995
74.134.35.54:443
75.131.72.82:443
71.222.30.198:443
111.125.70.30:2222
108.45.183.59:443
104.152.16.45:995
208.101.161.39:443
59.97.178.196:995
207.162.184.228:443
67.245.56.108:443
73.179.178.78:443
96.37.137.42:443
68.96.55.36:443
207.178.109.161:443
172.89.144.89:995
95.67.235.88:21
187.163.139.94:993
47.23.101.26:993
123.252.128.47:443
67.10.18.112:993
184.191.62.78:443
5.182.39.156:443
50.78.93.74:995
72.142.106.198:465
67.160.63.127:443
73.137.187.150:443
174.110.50.237:443
69.92.54.95:995
67.245.128.99:2222
104.175.240.29:443
67.250.76.135:443
107.12.140.181:443
93.177.144.236:443
104.173.119.54:2222
72.188.81.12:443
24.214.84.133:2222

Targets

- Target
  2026-04-25_f66d12a9cd213be8f3368592142b0249_amadey_elex_rhadamanthys_smoke-loader_stop
- Size 711KB
- SHA256 e29be826cf6f18408c98c5bab165d00192e92efdee576de6bce3e9f216295568
- MD5 f66d12a9cd213be8f3368592142b0249
- SHA1 61285a5196882bb69282ec0414865c992a28144c
- SHA512 097ad98ef7447b8dc44daadc291616cf2ce4335dd496185f953a58ec66ecd7683cea880c90829885209a7d1f1960e3f1bce60d0c828faf63e55cc0e6095fe603
- SSDEEP 12288:xIcPlwVdyqNxNKGUhUuW5DVHbF9B5ee5FRd5aixWcl5fMz2:xIcPidShqRbF0MVaixWyg
- TLSH
  T156F4AC91A7FC262CF5F37F366D7862254E3BBC96AC79DA4D12200D495CB2B4099E4323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker 1574838677 discovery qakbot stealer trojan
- Family: Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Qakbot/Qbot

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2