General
-
Target
npwaft.exe
-
Size
1.0MB
-
Sample
201121-ltk1jm4kt2
-
MD5
58ba34569c0946af50218f90a4ce0644
-
SHA1
3045e4c30b540b5d42ec8ec1a28b27e6d82b06d3
-
SHA256
ce11d0ec5b3dddfb0998fa5c3fde97bf16ad51ea1e0dd4e5595da0fcee03a0c9
-
SHA512
a876e0c875b39ca2433354b39c07ee0898b8a3acb2bd06f604b81e24fe49082e8e752cd137b52c26456c43eac09c22a00e4e0ff1148ce8ef551f256aa1f77956
Malware Config
Extracted
qakbot
notset
1604404534
Protocol: ftp- Host:
192.185.5.208 - Port:
21 - Username:
logger@dustinkeeling.com - Password:
NxdkxAp4dUsY
Protocol: ftp- Host:
162.241.218.118 - Port:
21 - Username:
logger@misterexterior.com - Password:
EcOV0DyGVgVN
Protocol: ftp- Host:
69.89.31.139 - Port:
21 - Username:
cpanel@vivekharris-architects.com - Password:
fcR7OvyLrMW6!
Protocol: ftp- Host:
169.207.67.14 - Port:
21 - Username:
cpanel@dovetailsolar.com - Password:
eQyicNLzzqPN
67.6.55.77:443
89.136.39.108:443
2.50.58.76:443
188.25.158.61:443
45.63.107.192:995
45.32.154.10:443
94.52.160.116:443
45.63.107.192:2222
45.63.107.192:443
72.204.242.138:465
84.117.176.32:443
95.77.223.148:443
47.146.39.147:443
41.225.13.128:8443
80.14.209.42:2222
190.220.8.10:995
66.76.105.194:443
105.101.69.242:443
89.33.87.107:443
75.136.40.155:443
Targets
-
-
Target
npwaft.exe
-
Size
1.0MB
-
MD5
58ba34569c0946af50218f90a4ce0644
-
SHA1
3045e4c30b540b5d42ec8ec1a28b27e6d82b06d3
-
SHA256
ce11d0ec5b3dddfb0998fa5c3fde97bf16ad51ea1e0dd4e5595da0fcee03a0c9
-
SHA512
a876e0c875b39ca2433354b39c07ee0898b8a3acb2bd06f604b81e24fe49082e8e752cd137b52c26456c43eac09c22a00e4e0ff1148ce8ef551f256aa1f77956
Score10/10-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Executes dropped EXE
-
Loads dropped DLL
-