Darlehensvertrag_42816504192_15052020.vbs

General
Target

Darlehensvertrag_42816504192_15052020.vbs

Filesize

36MB

Completed

19-05-2020 13:09

Score
10 /10
MD5

e44fb6c9a050ae7ef4b55cce6a71cdcd

SHA1

dd77b217e503fddaf28bb60b6e3280a692807976

SHA256

c888b058cd85352ec803eb2a6e78bef567b844e9982176efbcd7074982a760de

Malware Config

Extracted

Family qakbot
Botnet spx121
C2

72.209.191.27:443

72.204.242.138:443

47.202.98.230:443

72.204.242.138:465

96.35.170.82:2222

96.56.237.174:465

65.60.228.130:443

76.187.8.160:443

79.101.206.85:995

64.19.74.29:995

84.117.60.157:443

94.176.128.176:443

72.204.242.138:32102

187.155.61.44:443

72.204.242.138:443

73.163.242.114:443

86.127.7.148:21

76.187.97.98:2222

82.178.63.31:443

174.52.64.212:443

68.174.15.223:443

89.137.162.193:443

24.183.39.93:443

104.50.141.139:995

98.219.77.197:443

72.204.242.138:53

207.255.161.8:32102

1.40.42.4:443

70.183.127.6:995

74.33.69.208:443

66.222.88.126:995

47.152.210.233:443

5.107.144.131:2222

39.32.30.170:993

70.57.15.187:993

63.155.158.242:995

76.170.77.99:443

97.127.144.203:2222

74.215.201.122:443

95.77.144.238:443

72.204.242.138:50003

71.220.191.200:443

67.83.54.76:2222

73.214.231.2:443

68.1.171.93:443

97.119.244.150:443

201.183.224.74:443

75.183.135.48:443

79.118.105.207:443

78.97.207.104:443

Signatures

Filter: None

    Processes
    Network
    Replay Monitor
    00:00 00:00
    Downloads
    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Acsubziue\wnieyjug.dat

    • C:\Users\Admin\AppData\Roaming\Microsoft\Acsubziue\wnieyjug.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Acsubziue\wnieyjug.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Acsubziue\wnieyjug.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Acsubziue\wnieyjug.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Acsubziue\wnieyjug.exe

    • \Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Acsubziue\wnieyjug.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Acsubziue\wnieyjug.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Acsubziue\wnieyjug.exe

    • memory/952-18-0x00000000022E0000-0x00000000022F1000-memory.dmp

    • memory/1068-1-0x0000000002FB0000-0x0000000002FB4000-memory.dmp

    • memory/1572-12-0x00000000002F0000-0x000000000032A000-memory.dmp

    • memory/1608-5-0x0000000002350000-0x0000000002361000-memory.dmp

    • memory/1964-11-0x0000000002320000-0x0000000002331000-memory.dmp