DllRegisterServer
Static task
static1
Behavioral task
behavioral1
Sample
9d544e260209eac25746d3dd95bf8711db5499b780b457616f93bd790163a37c.dll
Resource
win7-en-20211208
General
-
Target
9d544e260209eac25746d3dd95bf8711db5499b780b457616f93bd790163a37c
-
Size
196KB
-
MD5
e62aa11da76ffb52305b5bd831fb7635
-
SHA1
e23233331a7a58424e8da1ed62a926ed8a018d74
-
SHA256
9d544e260209eac25746d3dd95bf8711db5499b780b457616f93bd790163a37c
-
SHA512
09d7c78a83d279692d638c9b8201231d8fa560ee370df715d112361225da9924b44ac91c3deb0ce1bf83f0b68561656c5498b9feee0bf88f36358e7d5a8aa2dc
-
SSDEEP
6144:8yvLH5hV0pO9Rr9c3ZPQFP3bO7OTBCxh+:dbVQO9Tc2FTO7OTcH+
Malware Config
Extracted
qakbot
401.138
abc114
1608129413
86.127.22.190:443
35.139.242.207:443
108.190.194.146:2222
187.213.199.54:443
68.83.89.188:443
41.233.152.232:993
196.151.252.84:443
181.208.249.141:443
172.87.134.226:443
96.27.47.70:2222
83.110.109.78:2222
93.86.1.159:995
217.162.149.212:443
80.11.210.247:443
72.252.201.69:443
185.163.221.77:2222
189.62.175.92:22
95.76.27.6:443
45.77.115.208:443
187.213.82.104:995
47.44.217.98:443
91.138.177.114:2222
72.240.200.181:2222
71.182.142.63:443
90.53.103.26:2222
81.97.154.100:443
45.118.216.157:443
70.118.146.154:995
83.202.68.220:2222
86.97.221.121:443
67.141.11.98:443
184.189.122.72:443
189.150.111.8:2222
24.229.150.54:995
200.38.254.177:443
109.106.69.138:2222
5.204.148.208:995
109.154.79.222:2222
190.220.8.10:995
87.27.110.90:2222
65.48.208.194:443
78.101.130.59:995
75.136.26.147:443
47.138.204.19:443
140.82.49.12:443
41.205.16.222:443
67.6.54.180:443
80.227.5.70:443
193.248.154.174:2222
93.148.241.179:2222
67.249.12.146:443
109.205.204.229:2222
90.201.21.58:443
50.29.166.232:995
144.202.38.185:995
149.28.99.97:443
45.77.115.208:995
144.202.38.185:443
149.28.101.90:2222
149.28.99.97:995
149.28.101.90:995
149.28.98.196:2222
209.137.209.158:443
144.202.38.185:2222
45.63.107.192:995
45.63.107.192:443
149.28.99.97:2222
217.39.74.146:2222
82.12.157.95:995
45.63.107.192:2222
149.28.98.196:443
66.97.247.15:443
149.28.98.196:995
108.46.145.30:443
78.101.158.1:61201
103.110.6.151:2087
5.12.11.200:443
78.63.226.32:443
46.53.14.19:443
116.240.78.45:995
75.67.192.125:443
161.142.217.62:443
151.60.38.21:443
86.98.21.136:443
188.26.59.21:443
75.109.180.221:995
217.128.117.218:2222
78.181.19.134:443
5.2.212.254:443
35.136.78.225:443
24.122.0.90:443
68.131.19.52:443
197.57.67.109:443
78.154.28.105:443
2.49.219.254:22
187.155.59.73:443
83.110.213.25:443
2.50.143.154:2222
85.105.29.218:443
151.61.125.180:2222
72.93.55.22:443
39.32.147.77:995
151.73.121.136:443
24.29.30.31:443
45.77.115.208:2222
72.214.55.195:995
208.93.202.41:443
2.7.69.217:2222
81.88.254.62:443
41.225.231.43:443
62.116.43.76:53
85.101.187.146:443
73.94.229.115:443
190.31.192.34:443
51.223.138.251:443
92.154.83.96:1194
65.131.41.96:995
90.61.38.208:2222
86.122.248.164:2222
74.222.204.82:995
190.128.215.174:443
86.245.82.249:2078
188.27.116.133:443
80.195.103.146:2222
85.60.132.8:2087
74.129.26.119:443
71.58.19.33:443
189.183.206.114:443
180.151.233.178:443
41.176.38.114:995
80.11.5.65:2222
196.221.77.89:995
75.136.40.155:443
86.121.3.80:443
24.139.72.117:443
94.52.68.72:443
2.91.9.248:443
79.129.252.62:2222
5.193.148.126:2078
72.36.59.46:2222
2.50.159.19:2222
37.105.7.219:995
196.204.207.111:443
105.198.236.99:443
184.179.14.130:22
203.106.116.190:443
81.150.181.168:2222
155.186.9.160:443
2.91.235.94:443
83.110.13.182:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot family
Files
-
9d544e260209eac25746d3dd95bf8711db5499b780b457616f93bd790163a37c.dll regsvr32 windows x86
a89679aec70fab3dbac762460558a4bc
Code Sign
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
inet_ntoa
psapi
GetModuleFileNameExW
msvcrt
_time64
strtod
_HUGE
localeconv
strchr
strncpy
malloc
free
qsort
memcpy
memmove
memset
atol
_vsnwprintf
_snprintf
_vsnprintf
_strtoi64
memchr
_errno
kernel32
lstrcmpA
lstrlenA
lstrcpynA
GetCurrentProcess
GetCurrentThread
MultiByteToWideChar
GetExitCodeThread
GetOEMCP
CreateMutexA
DuplicateHandle
GetCurrentProcessId
GetLastError
lstrcatA
CreateDirectoryW
DisconnectNamedPipe
lstrcpynW
GetProcessId
CopyFileW
lstrcatW
DeleteFileW
lstrcpyW
lstrcmpiW
CloseHandle
GetDriveTypeW
GetModuleHandleA
lstrlenW
MoveFileW
GetProcAddress
SwitchToThread
InterlockedIncrement
SetThreadPriority
HeapAlloc
HeapFree
HeapCreate
WideCharToMultiByte
FreeLibrary
GetSystemTimeAsFileTime
SetLastError
lstrcmpiA
LoadLibraryA
GetExitCodeProcess
CreatePipe
GetWindowsDirectoryW
FindFirstFileW
FindNextFileW
SetFileAttributesW
FlushFileBuffers
LocalAlloc
LoadLibraryW
GetTickCount
GetModuleFileNameW
GetSystemInfo
GetVersionExA
user32
CreateWindowExA
CharUpperBuffW
CharUpperBuffA
GetSystemMetrics
RegisterClassExA
DestroyWindow
DefWindowProcA
UnregisterClassA
advapi32
GetSidSubAuthority
OpenProcessToken
RegSetValueExW
RegQueryValueExW
IsTextUnicode
RegDeleteValueA
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegUnLoadKeyW
RegLoadKeyW
ConvertSidToStringSidW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ole32
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
oleaut32
SafeArrayGetUBound
SysAllocString
SysFreeString
SafeArrayGetElement
SafeArrayDestroy
VariantClear
SafeArrayGetLBound
userenv
GetUserProfileDirectoryW
Exports
Exports
Sections
.text Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ