qakbot | 612be3d31bbde599db89cb293b5b5ea2e9b7020ca3cadb7fbcc8f3627054146b

Sharing

Copy URL Twitter E-mail

General

Target
invoice.exe.mal
Size 704KB
Sample260508-ndvmaabt4q
SHA256 612be3d31bbde599db89cb293b5b5ea2e9b7020ca3cadb7fbcc8f3627054146b
MD5 40cd8343a9900f5c0484aa5ec45fac5e
SHA1 01d0aa199650529de47c262d4310e1e7f80eb4bf
SHA512 67ab7726e03800ab34a8862ca4fb231fdff5fde7106158115c7a871110d92d39f4d01d20864f662c32a615c8bd42dfc106fe4a8db9e6c13743fc2167d90d3c3f
SSDEEP 12288:a/4CKNlAJZ6Xs9W3FW198yMX88/i/FLoxU:abKNlO6c43FS6yM2OxU
TLSH
T1D2E41288B28604B1E4533D330D95EB6EB77D656785B90E36DB0B021BB9625E3003B7F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

323.91

Botnet

spx44

Campaign

1575969975

70.164.39.91:443
96.35.170.82:2222
96.37.137.42:443
75.70.218.193:443
73.226.220.56:443
104.152.16.45:995
24.184.6.58:2222
5.182.39.156:443
162.244.224.166:443
75.131.72.82:995
67.10.18.112:993
104.32.185.213:2222
181.126.80.118:443
75.131.72.82:443
71.84.5.114:995
62.103.70.217:995
47.40.244.237:443
208.101.161.39:443
72.16.212.107:465
205.250.79.62:443
96.241.184.247:443
217.162.149.212:443
174.25.163.79:443
67.214.201.117:8443
123.252.128.47:443
98.30.99.15:443
97.84.226.90:443
83.110.152.97:443
71.222.14.97:443
50.78.93.74:995
75.130.117.134:443
111.125.70.30:2222
181.197.195.138:995
73.232.165.200:995
67.246.180.90:443
49.191.134.225:995
75.182.214.87:443
50.247.230.33:995
185.219.83.73:443
172.78.87.180:995
117.223.145.94:995
71.77.231.251:443
73.164.25.107:443
198.72.239.252:443
104.175.193.24:443
2.50.157.249:443
162.244.225.30:443
47.146.169.85:443
74.194.4.181:443
75.170.56.34:995
173.22.120.11:2222
74.33.70.219:443
72.190.101.70:443
75.131.239.76:995
47.214.144.253:443
75.110.250.89:443
96.239.79.24:443
187.163.139.94:993
207.162.184.228:443
32.208.1.239:8443
74.134.35.54:443
108.45.183.59:443
47.202.98.230:443
173.3.132.17:995
184.191.62.78:443
70.177.25.99:443
80.14.209.42:2222
12.5.37.3:995
108.227.161.27:443
71.30.56.170:443
100.4.185.8:443
72.188.81.12:443
107.12.131.249:443
174.48.72.160:443
23.240.185.215:443
24.229.245.124:995
45.45.105.94:443
108.27.217.44:443
45.45.105.94:995
166.62.180.194:2078
47.23.101.26:465
108.160.123.244:443
68.174.15.223:443
75.81.25.223:995
198.72.193.198:2222
104.34.122.18:443
74.71.216.1:443
65.30.12.240:443
24.202.42.48:2222
107.12.140.181:443
173.172.205.216:443
68.83.59.107:443
184.180.157.203:2222
172.242.9.118:995
63.230.17.215:995
98.127.96.121:443
72.142.106.198:995
12.5.37.3:443
64.250.55.239:443
35.143.248.234:443
98.252.150.180:443
64.33.68.198:443
71.226.140.73:443
104.3.91.20:995
173.61.231.209:443
24.201.79.208:2078
75.165.179.143:465
64.19.74.29:995
174.20.189.226:995
67.246.16.250:995
72.224.159.224:2222
184.74.101.234:995
103.120.189.219:443
72.47.115.182:443
96.59.11.86:443
47.227.198.155:443
47.153.115.154:995
70.124.29.226:443
197.89.78.242:995
176.205.63.149:995
50.246.229.50:443
66.214.75.176:443
88.111.224.103:2222
72.211.97.57:443
192.40.225.168:443
72.183.255.148:443
24.164.79.147:443
47.155.19.205:443
174.131.181.120:995
12.176.32.146:443
68.174.117.63:443
99.228.5.106:443
206.51.202.106:50002
172.78.186.11:443
68.238.56.27:443
74.96.151.6:443
203.161.179.48:2222
104.34.186.27:995
73.200.219.143:443
75.142.59.167:443
73.85.86.191:443
72.132.145.25:443
106.201.171.101:443
47.18.180.37:443
62.47.252.79:993
67.245.56.108:443
98.148.177.77:443
173.81.22.235:443
68.206.128.75:443
2.185.67.169:995

Targets

- Target
  invoice.exe.mal
- Size 704KB
- SHA256 612be3d31bbde599db89cb293b5b5ea2e9b7020ca3cadb7fbcc8f3627054146b
- MD5 40cd8343a9900f5c0484aa5ec45fac5e
- SHA1 01d0aa199650529de47c262d4310e1e7f80eb4bf
- SHA512 67ab7726e03800ab34a8862ca4fb231fdff5fde7106158115c7a871110d92d39f4d01d20864f662c32a615c8bd42dfc106fe4a8db9e6c13743fc2167d90d3c3f
- SSDEEP 12288:a/4CKNlAJZ6Xs9W3FW198yMX88/i/FLoxU:abKNlO6c43FS6yM2OxU
- TLSH
  T1D2E41288B28604B1E4533D330D95EB6EB77D656785B90E36DB0B021BB9625E3003B7F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker spx44 1575969975 defense_evasion discovery execution qakbot persistence stealer trojan
- Family: Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Turns off Windows Defender SpyNet reporting
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2