qakbot | 7a227df10f82dc2e11822716aa04e91797e9a3011976a4e5884deb704bf0134a

Sharing

Copy URL Twitter E-mail

General

Target
gml01.dat
Size 368KB
Sample220321-vfpmdadca6
SHA256 7a227df10f82dc2e11822716aa04e91797e9a3011976a4e5884deb704bf0134a
MD5 81c36cf8c2b7ad174dc978f9f37ffdf6
SHA1 f12e439cca797508509120db4aaeeb32aaa24f12
SHA512 b803d6f1136df5fcad65b06ac67e74af14be716601e20f4269f63f652dbd50b80ee239e49c38a14eb76e45bc79959a4ca97dd54253c7f2fd8e92718ca70cd0fa
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.549

Botnet

gml01

Campaign

1647501143

76.69.155.202:2222
75.99.168.194:443
129.208.30.2:995
93.48.80.198:995
108.60.213.141:443
176.67.56.94:443
148.64.96.100:443
47.180.172.159:443
47.51.47.182:995
2.42.176.91:443
140.82.49.12:443
197.167.5.180:993
131.154.102.171:32100
86.195.158.178:2222
114.79.148.170:443
201.176.1.223:995
217.165.79.31:443
24.43.99.75:443
5.32.41.45:443
180.129.97.57:995
77.211.24.73:995
105.186.127.127:995
103.139.242.30:990
173.174.216.62:443
37.186.54.166:995
207.170.238.231:443
47.23.89.62:993
208.107.221.224:443
103.88.226.82:443
39.41.189.204:995
45.9.20.200:443
144.202.2.175:995
140.82.63.183:995
144.202.3.39:995
45.76.167.26:995
149.28.238.199:995
140.82.63.183:443
149.28.238.199:443
144.202.3.39:443
45.63.1.12:995
45.76.167.26:443
45.63.1.12:443
144.202.2.175:443
71.13.93.154:2222
75.99.168.194:61201
217.165.79.31:995
1.161.80.70:995
47.23.89.62:995
70.57.207.83:443
76.70.9.169:2222
31.35.28.29:443
69.159.200.138:2222
88.250.126.28:443
32.221.225.247:995
40.134.247.125:995
180.233.150.134:995
186.10.247.110:443
190.206.211.182:443
172.115.177.204:2222
110.143.139.163:443
70.46.220.114:443
86.98.27.253:443
117.248.109.38:21
38.70.253.226:2222
47.180.172.159:50010
86.98.8.203:995
75.159.9.236:443
72.76.94.99:443
172.114.160.81:995
125.25.6.23:443
58.105.167.35:50000
175.145.235.37:443
189.146.51.56:443
103.87.95.131:2222
174.69.215.101:443
197.89.8.135:443
67.209.195.198:443
91.177.173.10:995
78.100.194.196:6883
41.228.22.180:443
217.128.122.65:2222
39.52.45.169:993
76.169.147.192:32103
24.152.219.253:995
78.100.227.241:2222
195.32.57.18:80
92.99.229.158:2222
92.177.45.46:2078
177.207.108.236:993
45.239.129.13:443
120.150.218.241:995
76.25.142.196:443
39.52.45.169:995
75.188.35.168:443
217.165.109.52:993
39.44.151.33:995
74.15.2.252:2222
206.217.0.154:995
209.180.70.25:443
190.73.3.148:2222
128.106.122.216:443
182.191.92.203:995
67.165.206.193:993
121.74.187.191:995
173.21.10.71:2222
41.13.131.18:443
189.253.32.61:995
73.151.236.31:443
76.23.237.163:995
111.220.71.173:443
71.74.12.34:443
201.172.31.135:2222
201.170.181.247:443
148.64.96.100:993
201.145.160.158:443
189.237.6.251:443
161.142.48.212:443
201.103.6.221:443
47.156.191.217:443
103.211.39.220:465
82.51.28.59:995
72.252.201.34:995
79.167.209.26:995
72.252.201.34:990
177.207.108.236:995
63.143.92.99:995
105.226.9.8:995
70.51.135.39:2222
72.12.115.90:22
208.101.87.135:443
100.1.108.246:443
64.121.139.28:443
45.46.53.140:2222
24.55.67.176:443
24.229.150.54:995
86.198.170.170:2222
108.4.67.252:443
201.22.44.214:443
76.106.248.8:32103
41.84.248.120:995
86.97.8.111:443
109.12.111.14:443
5.81.177.71:2078
191.99.191.28:443
89.86.33.217:443
82.152.39.39:443
31.215.116.39:2222
191.112.22.95:443
72.66.116.235:995
80.11.74.81:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  gml01.dat
- Size 368KB
- SHA256 7a227df10f82dc2e11822716aa04e91797e9a3011976a4e5884deb704bf0134a
- MD5 81c36cf8c2b7ad174dc978f9f37ffdf6
- SHA1 f12e439cca797508509120db4aaeeb32aaa24f12
- SHA512 b803d6f1136df5fcad65b06ac67e74af14be716601e20f4269f63f652dbd50b80ee239e49c38a14eb76e45bc79959a4ca97dd54253c7f2fd8e92718ca70cd0fa
- MD5 SHA1 SHA512
Score

10^/10

qakbot gml01 1647501143 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2