5932c8742b819a8112fabdc0b9db1811

General
Target

Darlehensvertrag_237886470423_19052020.vbs

Filesize

36MB

Completed

20-05-2020 15:17

Score
10 /10
MD5

a6eb9d904fc5eddda76ad4f9cf678e03

SHA1

c370a3c9e108ae2452dfdedc91a2aa04634c7002

SHA256

dfacae17a54e54e9b25d77399619859ed6b196318bd06341c22c7a8b4a090254

Malware Config

Extracted

Family qakbot
Botnet spx123
C2

71.77.252.14:2222

174.130.225.61:443

76.187.97.98:2222

187.19.151.218:995

82.127.193.151:2222

72.204.242.138:993

72.204.242.138:993

66.208.105.6:443

24.183.39.93:443

98.243.187.85:443

68.49.120.179:443

72.204.242.138:995

72.29.181.77:2078

72.204.242.138:443

24.136.33.120:2222

96.56.237.174:990

107.2.148.99:443

216.201.162.158:443

71.213.29.14:995

84.247.55.190:443

86.124.2.219:443

189.236.29.119:443

199.116.241.147:443

79.115.20.123:443

67.170.137.8:443

200.113.201.83:993

100.12.173.247:995

82.210.157.185:443

79.78.131.124:443

186.94.179.27:2078

102.41.121.242:995

24.202.42.48:2222

208.93.202.49:443

72.16.212.108:465

98.118.156.172:443

31.125.140.150:2222

5.36.67.194:443

108.30.125.94:443

190.130.235.79:443

151.205.102.42:443

68.39.160.40:443

68.204.164.222:443

108.54.205.207:443

47.203.89.185:443

79.114.195.15:443

174.34.67.106:2222

73.214.231.2:443

96.18.240.158:443

156.222.43.142:995

178.27.203.107:443

Signatures

Filter: None

    Processes
    Network
    Replay Monitor
    00:00 00:00
    Downloads
    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.dat

    • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe

    • \Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe

    • memory/272-1-0x0000000002F10000-0x0000000002F14000-memory.dmp

    • memory/1140-12-0x0000000000300000-0x000000000033A000-memory.dmp

    • memory/1196-5-0x0000000002270000-0x0000000002281000-memory.dmp

    • memory/1600-11-0x00000000024F0000-0x0000000002501000-memory.dmp