11.bin

General
Target

11.bin

Filesize

N/A

Completed

11-11-2019 10:30

Score
10 /10
MD5

N/A

SHA1

N/A

SHA256

13c2f4b6fb80500884a4ea9d2fe80774124f46ebfd80de3e1dfcfb9e167aee08

Malware Config

Extracted

Family qakbot
C2

107.12.140.181:443

67.5.33.229:2078

184.74.101.234:995

172.78.45.13:995

181.95.16.207:443

50.246.229.50:443

207.179.194.91:443

67.246.16.250:995

75.110.250.89:443

173.91.254.236:443

50.78.93.74:995

73.104.218.229:0

47.23.101.26:993

88.111.255.235:2222

12.5.37.3:995

24.30.71.200:443

72.29.181.77:2078

98.155.154.220:443

196.194.74.33:2222

47.214.144.253:443

67.10.18.112:993

73.232.165.200:995

115.132.97.136:443

47.202.98.230:443

71.93.60.90:443

72.46.151.196:995

137.25.72.175:443

67.160.63.127:443

197.86.194.53:995

75.142.59.167:443

47.155.19.205:443

182.56.89.221:995

2.90.219.43:443

105.246.75.20:995

75.110.90.155:443

166.62.180.194:2078

62.103.70.217:995

107.12.131.249:443

98.186.155.8:443

47.153.115.154:443

108.5.34.128:443

76.169.19.193:443

45.37.57.119:2222

76.116.128.81:443

2.50.41.185:443

95.67.238.16:21

107.184.252.92:443

75.130.117.134:443

70.183.3.199:443

72.142.106.198:993

Signatures

Filter: None

    Processes
    Network
    Replay Monitor
    00:00 00:00
    Downloads
    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.dat

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • memory/1320-7-0x0000000002240000-0x00000000022D2000-memory.dmp

    • memory/1456-0-0x0000000002580000-0x0000000002591000-memory.dmp

    • memory/1928-12-0x00000000025C0000-0x00000000025D1000-memory.dmp

    • memory/2028-6-0x0000000002600000-0x0000000002611000-memory.dmp