Qakbot

Hunt queries (Shodan, Censys, Fofa, URLScan)

Hunt query sharings are temporarily disabled.

Summary

TL; DR: Qakbot (AKA Qbot or Pinkslipbot) is a modular second-stage malware with backdoor capabilities, initially purposed as a credential stealer

Type: Information stealer/loader

Targeted Operating Systems: Windows

Interesting characteristics: Used as a loader for different other threats

Threat tag: win.qakbot

Reporting: https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot 

IOCs

• 65.108.218.24:443
• 5.149.249.185:443
• 185.156.172.62:443
• 31.210.173.10:443
• 5.252.177.195:443
• 38.180.142.98:443
• 45.85.117.76:443
• 93.88.74.63:443
• 77.73.39.76:443
• 185.117.90.142:2222
• 62.204.41.234:2222
• 94.158.247.56:443
• 77.105.162.176:995
• 77.105.162.97:443
• 85.49.243.234:2222
• 105.155.177.133:995
• 179.158.101.198:443
• 84.212.127.234:443
• 78.100.236.181:995
• 39.40.183.67:995
• 202.187.231.188:995
• 167.56.121.249:995
• 95.20.17.129:443
• 173.24.8.121:2222
• 75.90.82.104:995
• 151.30.51.255:443
• 168.149.16.139:443
• 79.107.151.150:995
• 78.19.61.12:2222
• 69.156.55.183:2222
• 41.86.42.158:995
• 31.117.25.91:2222
• 41.96.125.98:443
• 78.101.24.11:443
• 83.213.202.225:993
• 109.48.28.129:2222
• 95.116.67.173:443
• 86.236.11.235:2222
• 77.49.56.209:995
• 31.46.55.159:443
• 86.98.19.74:443
• 66.131.25.6:443
• 41.230.86.197:443
• 31.117.7.53:2222
• 39.40.128.22:995
• 105.102.19.215:443
• 90.93.86.137:2222
• 41.96.34.101:443
• 37.211.19.15:443
• 24.46.79.89:2222
• 70.31.125.177:2222
• 2.6.198.137:2222
• 73.155.10.152:443
• 70.27.138.200:2078
• 70.27.138.200:2222
• 85.243.247.137:443
• 154.247.5.62:993
• 154.246.13.166:2078
• 50.99.8.5:443
• 39.40.163.25:995
• 86.225.209.225:2222
• 184.63.241.238:443
• 184.20.220.17:443
• 99.196.212.115:443
• 125.209.114.181:995