1.bin

General
Target

1.bin

Filesize

N/A

Completed

11-11-2019 10:28

Score
10 /10
MD5

N/A

SHA1

N/A

SHA256

f614a06748251107a34fa7e44c7652fd88e61fd958df724455e14ec88040abf9

Malware Config

Extracted

Family qakbot
C2

206.51.202.106:50003

173.3.132.17:995

75.131.72.82:443

68.238.144.55:443

100.4.185.8:443

5.182.39.156:443

24.201.68.105:2078

23.240.185.215:443

69.92.54.95:995

68.131.9.203:443

187.163.139.200:993

75.81.25.223:995

32.208.1.239:443

170.10.78.48:443

74.194.4.181:443

81.147.42.195:2222

71.30.56.170:443

174.16.234.171:993

66.214.75.176:443

47.153.115.154:443

75.175.209.163:995

72.213.98.233:443

173.22.120.11:2222

68.238.56.27:443

184.180.157.203:2222

24.203.64.26:2222

47.153.115.154:995

64.19.74.29:995

104.32.185.213:2222

104.3.91.20:995

107.12.140.181:443

67.5.33.229:2078

67.10.18.112:993

80.14.209.42:2222

184.74.101.234:995

172.78.45.13:995

181.14.188.8:443

106.51.0.228:443

67.246.16.250:995

75.110.250.89:443

50.78.93.74:995

104.175.193.24:443

209.182.122.217:443

47.23.101.26:993

12.5.37.3:995

24.30.71.200:443

72.29.181.77:2078

90.43.6.185:2222

81.149.189.61:8443

5.89.115.73:2222

Signatures

Filter: None

    Processes
    Network
    Replay Monitor
    00:00 00:00
    Downloads
    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.dat

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe

    • memory/844-0-0x0000000002750000-0x0000000002761000-memory.dmp

    • memory/1500-7-0x00000000020E0000-0x0000000002172000-memory.dmp

    • memory/1908-6-0x0000000002610000-0x0000000002621000-memory.dmp

    • memory/2024-12-0x0000000002610000-0x0000000002621000-memory.dmp