Kaufvertrag_335774592927_20052020.vbs

General
Target

Kaufvertrag_335774592927_20052020.vbs

Filesize

36MB

Completed

24-05-2020 14:08

Score
10 /10
MD5

e4c51a265a25b187d92ce90b381aff5f

SHA1

b95bb9ca726d717703880c340f7a5c3c3f5e7bed

SHA256

a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44

Malware Config

Extracted

Family qakbot
Botnet spx124
C2

188.173.185.139:443

117.241.53.130:443

81.103.144.77:443

217.219.50.172:990

103.76.160.110:443

68.204.164.222:443

98.32.60.217:443

173.245.152.231:443

72.240.245.253:443

112.171.126.153:443

141.85.114.172:443

31.5.189.71:443

71.77.231.251:443

72.190.101.70:443

140.82.21.191:443

31.5.41.52:443

78.188.109.130:443

70.124.29.226:443

24.43.22.220:993

101.108.114.66:443

137.103.143.124:443

203.213.104.25:995

182.56.134.44:995

24.201.79.208:2078

24.110.96.149:443

98.222.23.221:443

50.104.186.71:443

67.83.54.76:2222

104.36.135.227:443

68.1.171.93:443

24.43.22.220:995

75.183.171.155:3389

47.41.3.40:443

68.98.142.248:995

81.133.234.36:2222

98.121.187.78:443

47.205.231.60:443

66.26.160.37:443

69.92.54.95:995

67.209.195.198:3389

41.228.231.93:443

184.98.104.7:995

72.204.242.138:6881

210.61.141.92:443

35.142.12.163:2222

24.46.40.189:2222

96.56.237.174:993

189.231.179.154:443

98.115.138.61:443

50.29.166.232:995

Signatures

Filter: None

    Processes
    Network
    Replay Monitor
    00:00 00:00
    Downloads
    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.dat

    • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe

    • \Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe

    • \Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe

    • memory/612-12-0x0000000001ED0000-0x0000000001F0A000-memory.dmp

    • memory/728-5-0x0000000002310000-0x0000000002321000-memory.dmp

    • memory/1016-1-0x0000000003010000-0x0000000003014000-memory.dmp

    • memory/1588-11-0x0000000002270000-0x0000000002281000-memory.dmp