9.bin

General
Target

9.bin

Filesize

N/A

Completed

11-11-2019 10:30

Score
10 /10
MD5

N/A

SHA1

N/A

SHA256

6b88260f4c4da4651a82bb62761cd23ee9ad6662a2a0abbec017e7193668397b

Malware Config

Extracted

Family qakbot
C2

173.3.132.17:995

75.131.72.82:443

68.238.144.55:443

100.4.185.8:443

80.14.209.42:2222

24.253.109.46:443

5.182.39.156:443

201.188.17.26:443

23.240.185.215:443

69.92.54.95:995

68.131.9.203:443

187.163.139.200:993

75.81.25.223:995

24.201.68.105:2078

32.208.1.239:443

170.10.78.48:443

74.194.4.181:443

71.30.56.170:443

174.16.234.171:993

47.153.115.154:443

75.175.209.163:995

68.238.56.27:443

173.22.120.11:2222

184.180.157.203:2222

24.203.64.26:2222

99.228.5.106:443

47.153.115.154:995

64.19.74.29:995

104.3.91.20:995

72.214.25.227:995

73.37.61.237:443

76.181.237.223:443

107.12.140.181:443

67.5.33.229:2078

50.246.229.50:443

67.246.16.250:995

75.130.117.134:443

75.110.250.89:443

173.91.254.236:443

50.78.93.74:995

197.89.78.71:995

5.89.115.73:2222

47.23.101.26:993

12.5.37.3:995

24.30.71.200:443

72.29.181.77:2078

71.93.60.90:443

72.46.151.196:995

173.233.182.249:443

67.10.18.112:993

Signatures

Filter: None

    Processes
    Network
    Replay Monitor
    00:00 00:00
    Downloads
    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.dat

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • memory/988-7-0x0000000002350000-0x00000000023E2000-memory.dmp

    • memory/1000-6-0x0000000002740000-0x0000000002751000-memory.dmp

    • memory/1368-0-0x00000000025F0000-0x0000000002601000-memory.dmp

    • memory/1536-12-0x00000000026B0000-0x00000000026C1000-memory.dmp