update2.exe

General
Target

update2.exe

Filesize

746KB

Completed

04-11-2019 11:18

Score
10 /10
MD5

0bfb4a1efbb20a7291fcc022dec7d58b

SHA1

faec2a0afe296224f980ac059cf63f18eba800ce

SHA256

73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

Malware Config

Extracted

Family qakbot
C2

112.171.126.153:443

67.200.146.98:2222

174.16.234.171:993

71.30.56.170:443

71.77.231.251:443

72.213.98.233:443

2.50.170.151:443

184.180.157.203:2222

96.35.170.82:2222

64.19.74.29:995

104.32.185.213:2222

104.3.91.20:995

173.22.120.11:2222

173.3.132.17:995

74.194.4.181:443

75.131.72.82:443

68.238.144.55:443

100.4.185.8:443

104.34.122.18:443

65.30.12.240:443

24.201.68.105:2087

32.208.1.239:443

168.245.228.71:443

47.153.115.154:995

24.201.68.105:2078

23.240.185.215:443

72.47.115.182:443

187.163.139.200:993

75.81.25.223:995

5.182.39.156:443

75.130.117.134:443

73.145.189.17:443

181.47.60.21:995

72.29.181.77:2083

81.147.42.195:2222

68.238.56.27:443

116.72.208.166:2222

78.94.55.26:50003

50.246.229.50:443

98.186.90.192:995

185.219.83.73:443

108.45.183.59:443

66.214.75.176:443

67.10.18.112:993

184.74.101.234:995

107.12.140.181:443

172.78.45.13:995

50.78.93.74:995

67.246.16.250:995

47.148.143.146:443

Signatures

Filter: None

    Processes
    Network
    Replay Monitor
    00:00 00:00
    Downloads
    • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.dat

    • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe

    • memory/364-5-0x0000000002800000-0x0000000002892000-memory.dmp

    • memory/3060-4-0x0000000002A80000-0x0000000002A81000-memory.dmp

    • memory/4152-9-0x0000000002800000-0x0000000002801000-memory.dmp

    • memory/4976-0-0x0000000002AF0000-0x0000000002AF1000-memory.dmp