Qakbot (Qbot) - это банковский троян - вредоносная программа, предназначенная для сбора банковской информации у жертв. Qbot нацелен на организации преимущественно в США. Он оснащен различными сложными функциями уклонения и кражи информации, червеподобной функциональностью и сильным механизмом персистенции.
Qakbot Malware IOCs
- Qbot Botnet IOC
- Qbot Trojan IOCs
- Qakbot (Qbot) Trojan IOCs
- Qakbot Malware IOCs
- Qakbot Malware IOCs - Part 5
- Qakbot Malware IOCs - Part 6
- Qakbot Trojan IOCs - Part 7
- Qakbot Trojan IOCs - Part 8
- Qakbot Trojan IOCs - Part 9
- Qakbot Trojan IOCs - Part 10
- Qakbot Trojan IOCs - Part 11
- Qakbot Trojan IOCs - Part 12
Indicators of Compromise
IPv4 Port Combinations
- 100.16.107.117:443
- 100.8.168.108:443
- 102.156.232.220:443
- 103.144.201.62:2078
- 105.109.140.201:32103
- 108.162.6.34:443
- 108.162.6.34:995
- 108.6.249.139:443
- 109.218.104.206:2222
- 116.75.63.225:443
- 12.172.173.82:22
- 12.172.173.82:465
- 12.172.173.82:993
- 12.172.173.82:995
- 121.122.99.223:995
- 122.178.197.139:995
- 123.3.240.16:995
- 130.43.99.103:995
- 136.232.184.134:995
- 136.244.25.165:443
- 149.126.159.106:443
- 170.253.25.35:443
- 172.117.139.142:995
- 173.18.126.3:443
- 173.239.94.212:443
- 174.104.184.149:443
- 174.112.25.29:2078
- 174.77.209.5:443
- 175.205.2.54:443
- 176.142.207.63:443
- 176.151.15.101:443
- 184.153.132.82:443
- 184.155.91.69:443
- 184.176.154.83:995
- 187.199.224.16:32103
- 190.11.198.66:443
- 190.18.236.175:443
- 190.207.253.41:2222
- 190.39.199.51:443
- 193.154.207.221:443
- 197.3.64.204:995
- 2.83.62.105:443
- 2.91.184.252:995
- 213.67.255.57:2222
- 216.196.245.102:2083
- 216.196.245.102:2222
- 217.128.91.196:2222
- 23.240.47.58:995
- 24.142.218.202:443
- 24.206.27.39:443
- 24.64.114.59:2078
- 24.64.114.59:2222
- 24.64.114.59:3389
- 24.64.114.59:50010
- 31.167.227.31:443
- 45.248.169.101:443
- 47.229.96.60:443
- 47.41.154.250:443
- 50.68.204.71:443
- 50.68.204.71:993
- 50.90.249.161:443
- 58.162.223.233:443
- 58.186.75.42:443
- 58.247.115.126:995
- 62.31.130.138:465
- 64.121.161.102:443
- 66.191.69.18:995
- 69.119.123.159:2222
- 70.115.104.126:995
- 70.120.228.205:2083
- 71.247.10.63:50003
- 73.36.196.11:443
- 74.92.243.113:50000
- 75.141.227.169:443
- 75.143.236.149:443
- 75.158.15.211:443
- 75.98.154.19:443
- 75.99.125.235:2222
- 76.100.159.250:443
- 76.20.42.45:443
- 76.80.180.154:995
- 77.126.81.208:443
- 78.69.251.252:2222
- 80.13.179.151:2222
- 81.229.117.95:2222
- 82.9.210.36:443
- 83.110.223.247:443
- 83.21.138.251:2222
- 83.92.85.93:443
- 84.35.26.14:995
- 85.152.152.46:443
- 85.241.180.94:443
- 85.52.73.34:2222
- 85.7.61.22:2222
- 86.159.48.25:2222
- 86.171.75.63:443
- 86.195.32.149:2222
- 86.225.214.138:2222
- 86.98.182.30:2222
- 87.221.197.110:2222
- 87.223.85.4:443
- 89.129.109.27:2222
- 90.104.22.28:2222
- 90.116.219.167:2222
- 91.169.12.198:32100
- 92.106.70.62:2222
- 92.11.189.236:2222
- 92.137.74.174:2222
- 92.185.204.18:2078
- 92.186.69.229:2222
- 92.239.81.124:443
- 92.24.200.226:995
- 92.27.86.48:2222
- 92.98.228.28:2222
- 93.147.235.8:443
- 93.156.103.241:443
- 93.24.192.142:20
- 94.63.65.146:443
- 98.145.23.67:443
98.147.155.235:443
URLs
- https://100mesa.com/iet/index.php?sed-tietsriav=1
SHA256
- 3da1cb0608f3709bf1331c4088fb258daf0200740b9b67afc6eec68a7f4b111a
- 7d1d7d196b3932e4e3e7cc1159f0e3ebab252f6a5f1ed6000f78d2133052a0de
- 9546ad96dd59612da1ea20637613ad0c1154e599b3c5a37b5404f4301cf78348
- d0f396309db14bbe988e8ae6ba6dfb4451fc9db830484dcb7dec830b74d8467a
- e6f4fe47c6e08c3b995b5e69efee09a853426607d64715bb1cf215640f785d58