qakbot | 5d62cbd1c137333a510d67a26d86ef27a0230a421f25516cfcb6df49cc91c953

Sharing

Copy URL Twitter E-mail

General

Target
V0YE.DAT
Size 670KB
Sample220708-3fdh4saebp
SHA256 5d62cbd1c137333a510d67a26d86ef27a0230a421f25516cfcb6df49cc91c953
MD5 f28fdcbc41fceb3ce2a70a42d302fd88
SHA1 18422899948bf5e9b949424ec305954546e11976
SHA512 589817902eda9d8fe674730d2ac4eb50ef92159f32a4333bb97530efbb5093d770d28567f8c3f883e2da6530c9cfd5f636e2f65c251a9930d1a9f57807cbcb1c
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama199

Campaign

1657265474

121.7.223.45:2222
67.209.195.198:443
148.64.96.100:443
92.132.132.81:2222
217.128.122.65:2222
47.180.172.159:443
173.174.216.62:443
70.46.220.114:443
32.221.224.140:995
69.14.172.24:443
117.248.109.38:21
94.59.15.180:2222
38.70.253.226:2222
217.165.157.202:995
41.228.22.180:443
67.165.206.193:993
172.115.177.204:2222
186.90.153.162:2222
47.23.89.60:993
120.150.218.241:995
93.48.80.198:995
89.211.209.234:2222
197.89.12.70:443
208.107.221.224:443
24.178.196.158:2222
66.230.104.103:443
118.161.14.242:995
24.158.23.166:995
100.38.242.113:995
37.208.132.76:50010
63.143.92.99:995
182.191.92.203:995
86.97.246.166:1194
74.14.5.179:2222
40.134.246.185:995
111.125.245.116:995
173.21.10.71:2222
76.25.142.196:443
142.186.49.224:2222
118.161.14.242:443
174.69.215.101:443
187.172.164.12:443
129.208.151.177:995
70.51.137.244:2222
190.252.242.69:443
24.55.67.176:443
103.246.242.202:443
89.101.97.139:443
47.156.129.52:443
72.252.157.93:993
72.252.157.93:990
72.252.157.93:995
177.94.65.26:32101
24.139.72.117:443
82.41.63.217:443
179.158.105.44:443
81.132.186.218:2078
201.172.20.167:2222
37.186.58.99:995
37.34.253.233:443
125.25.133.223:443
45.241.254.69:993
39.49.41.221:995
196.203.37.215:80
88.240.59.52:443
39.44.60.200:995
86.97.10.37:443
86.98.157.114:993
109.12.111.14:443
81.193.30.90:443
39.52.59.221:995
39.41.16.210:995
106.51.48.188:50001
86.97.209.138:2222
104.34.212.7:32103
86.213.75.30:2078
45.46.53.140:2222
39.57.56.11:995
84.241.8.23:32103
2.178.166.220:61202
24.43.99.75:443
101.50.67.155:995
41.13.224.28:443
108.56.213.219:995
189.253.167.141:443
5.32.41.45:443
120.61.1.141:443
177.189.180.214:32101
94.36.193.176:2222
39.53.124.57:995
80.11.74.81:2222
41.84.224.109:443
103.116.178.85:995
209.15.76.228:443
184.97.29.26:443
102.65.66.66:443
39.52.221.9:995
191.112.26.57:443
210.246.4.69:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  V0YE.DAT
- Size 670KB
- SHA256 5d62cbd1c137333a510d67a26d86ef27a0230a421f25516cfcb6df49cc91c953
- MD5 f28fdcbc41fceb3ce2a70a42d302fd88
- SHA1 18422899948bf5e9b949424ec305954546e11976
- SHA512 589817902eda9d8fe674730d2ac4eb50ef92159f32a4333bb97530efbb5093d770d28567f8c3f883e2da6530c9cfd5f636e2f65c251a9930d1a9f57807cbcb1c
- MD5 SHA1 SHA512
Score

10^/10

qakbot obama199 1657265474 banker stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Qakbot/Qbot

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2