Qakbot (Qbot) - это банковский троян - вредоносная программа, предназначенная для сбора банковской информации у жертв. Qbot нацелен на организации преимущественно в США. Он оснащен различными сложными функциями уклонения и кражи информации, червеподобной функциональностью и сильным механизмом персистенции.
Indicators of Compromise
IPv4 Port Combinations
- 100.6.31.96:443
- 102.156.133.23:443
- 102.157.31.224:443
- 102.158.70.210:443
- 102.159.27.52:443
- 103.111.70.66:443
- 103.123.223.171:443
- 103.140.174.20:2222
- 103.141.50.79:995
- 103.144.201.56:2078
- 103.212.19.254:995
- 103.42.86.42:995
- 104.35.24.154:443
- 105.184.209.10:995
- 105.184.209.139:995
- 107.146.12.26:2222
- 108.190.115.159:443
- 109.153.252.176:2222
- 109.218.108.3:2222
- 109.50.128.59:2222
- 112.222.83.147:6881
- 114.143.176.235:443
- 116.75.58.134:443
- 116.75.58.209:443
- 119.82.121.87:443
- 12.172.173.82:20
- 12.172.173.82:2087
- 12.172.173.82:21
- 12.172.173.82:22
- 12.172.173.82:32101
- 12.172.173.82:465
- 12.172.173.82:50001
- 12.172.173.82:993
- 12.172.173.82:995
- 122.184.143.85:443
- 125.99.76.102:443
- 139.226.47.229:995
- 14.192.241.76:995
- 144.64.226.144:443
- 147.147.30.126:2222
- 147.219.4.194:443
- 149.74.159.67:2222
- 151.213.66.34:995
- 151.65.214.218:443
- 161.142.98.36:995
- 162.248.14.107:443
- 171.96.204.242:443
- 173.18.122.24:443
- 173.184.44.185:443
- 173.88.135.179:443
- 174.4.89.3:443
- 176.142.207.63:443
- 176.202.45.209:443
- 178.175.187.254:443
- 181.118.183.109:443
- 184.176.35.223:2222
- 184.182.66.109:443
- 186.64.67.41:443
- 188.28.72.118:443
- 193.253.53.157:2078
- 194.118.121.231:995
- 197.14.179.187:443
- 197.2.249.187:443
- 197.94.78.32:443
- 198.2.51.242:993
- 2.36.64.159:2078
- 2.82.8.80:443
- 201.244.108.183:995
- 213.91.235.146:443
- 217.165.234.249:443
- 217.55.0.153:995
- 23.30.173.133:443
- 24.206.27.39:443
- 24.236.90.197:2078
- 24.69.137.232:2222
- 27.109.19.90:2078
- 27.99.32.26:2222
- 31.53.29.198:2222
- 35.143.97.145:995
- 41.186.88.38:443
- 41.62.162.197:443
- 46.24.47.243:995
- 47.205.25.170:443
- 47.21.51.138:443
- 47.34.30.133:443
- 50.68.186.195:443
- 50.68.204.71:443
- 50.68.204.71:993
- 50.68.204.71:995
- 58.162.223.233:443
- 62.35.230.21:995
- 64.40.4.89:995
- 67.10.9.125:995
- 68.173.170.110:8443
- 68.229.150.95:443
- 69.123.4.221:2222
- 69.133.162.35:443
- 70.112.206.5:443
- 70.24.104.146:2222
- 70.26.75.148:2222
- 70.28.50.223:1194
- 70.28.50.223:2078
- 70.28.50.223:2083
- 70.28.50.223:32100
- 70.28.50.223:3389
- 70.64.77.115:443
- 71.38.155.217:443
- 71.78.95.86:995
- 72.134.124.16:443
- 72.205.104.134:443
- 73.0.34.177:443
- 74.92.243.115:50000
- 74.93.148.97:995
- 75.109.111.89:443
- 75.143.236.149:443
- 75.98.154.19:443
- 76.16.49.134:443
- 76.170.252.153:995
- 76.86.31.59:443
- 78.130.215.67:443
- 78.16.206.86:443
- 79.77.142.22:2222
- 81.111.108.123:443
- 81.229.117.95:2222
- 81.240.235.122:2222
- 82.127.153.75:2222
- 82.36.36.76:443
- 86.130.9.128:2222
- 86.140.160.231:2222
- 86.171.131.244:995
- 86.208.35.220:2222
- 86.236.114.212:2222
- 86.250.12.86:2222
- 87.220.204.177:2222
- 88.126.94.4:50000
- 89.114.140.100:443
- 89.129.109.27:2222
- 89.79.229.50:443
- 91.165.188.74:50000
- 91.169.12.198:32100
- 91.75.121.31:443
- 92.1.170.110:995
- 92.186.69.229:2222
- 92.188.241.102:443
- 92.20.199.185:2222
- 92.20.204.198:2222
- 92.239.81.124:443
- 92.27.86.48:2222
- 92.9.45.20:2222
- 92.97.119.138:2222
- 93.150.183.229:2222
- 94.200.183.66:2222
- 94.204.122.51:443
- 96.56.197.26:2083
- 96.56.197.26:2222
- 98.145.23.67:443
- 99.230.89.236:2078
- 99.230.89.236:2083
URLs
- https://abragest.com/yKmmLBY/170
- https://auditoresmenendez.com/HLLMkLW/t6gtn2TDPAe8
- https://dcnchurch.info/vS0t89/5KZ0qW1kB1
- https://demosites.live/zAjzkL/200
- https://greyfordacademy1.com/qsf4/xaBkPi2Yyl
- https://isosware.com/ncsa/sedsit.php?
- https://lascumbres.com.mx/4Xe/jrWfjHIL
- https://mrketiando.com.br/mTHv/58WHXG5
- https://puntoproduction.com/87bacDu/1704
- https://travellingsands.com/rmt/remet.php?
- https://tridayaonline.com/rf7H/1203
SHA256
- 034deaad444c00dcd5a4ba131105be43b1c133dff87033b8d26c484df6bbbb76
- 1e9e97f45143f1135c52fa930ea2836a6eed8093c4db45906e4ce9178c03b312
- 2f5fa112a3851103950f2aac5c58fe715e2e55277ed1e17edf556d00148dec06
- 9b2bd1b4f2fd43ce8ff4bd2f39f984f4232bc69df061853e734a3e60d20b4b38
- b5ae6ab8f5910f1ce1ca2a1cc14a6bf567a663c560062db7cd38c9de5efaf700
- c876b02b457a9762d56059abd0fe333a54bba9abf6e2eac051a74cc0d5ac8e30
- c974fc0afc08bd056253294691366303b58fc1a6d76fa7c6f837d3932fc049fe
- e129d7e093e1ab82b09c0b4d9c23f71ee8c50bff17ac9f9a2bc71fec053fd3e9
