Static task
static1
Behavioral task
behavioral1
Sample
49306264f814120088dd56af325db4f43ef3a0142b18ce482d021ae098d776e0.exe
Resource
win7-en-20211208
General
-
Target
49306264f814120088dd56af325db4f43ef3a0142b18ce482d021ae098d776e0
-
Size
221KB
-
MD5
007d64063d521e8dd2b7cd476c7a81f6
-
SHA1
92ac76f5cadbf4473e51cecff07d901569f40608
-
SHA256
49306264f814120088dd56af325db4f43ef3a0142b18ce482d021ae098d776e0
-
SHA512
8a9b43664242543bb03ab61e3807657fcd745ec514b0e639183b403fb620627d529cea0573f0342f1a682dc60694a68aa3c8d1d707d30a4102f1376258a5631d
-
SSDEEP
6144:9iCJP2aHgie+IjmQ6Jg2Ppa9bca9AQeS75+0P:9fBe+QmXJg2aSa9JeSt+0P
Malware Config
Extracted
qakbot
324.75
spx91
1586264831
100.38.123.22:443
72.16.212.107:465
65.131.79.162:995
65.96.36.157:443
24.61.47.73:443
73.192.209.168:443
93.114.89.119:995
71.58.21.235:443
68.174.9.179:443
73.137.187.150:443
71.178.38.101:443
50.29.181.193:995
31.5.189.71:443
68.49.120.179:443
24.203.36.180:2222
81.102.127.116:443
86.106.126.189:443
68.224.192.39:443
184.21.151.81:995
173.175.29.210:443
152.32.80.37:443
65.101.165.149:995
66.225.65.155:32101
78.96.148.177:443
47.203.89.185:443
79.117.239.170:443
216.16.178.115:443
206.183.190.53:995
173.216.174.39:443
186.135.13.215:443
97.96.51.117:443
5.13.221.230:443
24.37.178.158:443
47.136.224.60:443
68.39.177.147:995
72.29.181.77:2078
96.227.122.123:443
47.180.66.10:443
72.224.215.180:2222
47.202.98.230:443
184.180.157.203:2222
86.124.109.100:443
64.121.114.87:443
75.89.199.86:443
181.126.86.223:443
70.170.111.174:443
206.169.163.147:995
73.226.220.56:443
173.172.205.216:443
89.137.162.193:443
50.246.229.50:443
98.190.24.81:443
72.190.101.70:443
62.231.107.180:443
73.156.64.203:443
50.244.112.106:443
67.209.195.198:3389
47.146.169.85:443
24.110.14.40:443
39.35.20.148:995
100.4.185.8:443
31.5.116.167:443
24.99.180.247:443
24.158.103.220:443
65.189.49.227:443
5.13.126.243:443
76.180.69.236:443
75.183.171.155:3389
89.137.54.252:8443
72.80.137.215:443
96.41.93.96:443
100.33.132.135:443
95.77.237.115:443
70.62.160.186:6883
68.41.60.225:443
100.40.48.96:443
47.41.3.40:443
98.164.253.75:443
68.174.15.223:443
199.241.223.66:443
208.93.202.49:443
64.19.74.29:995
66.26.160.37:443
86.107.86.177:443
12.5.37.3:443
50.247.230.33:995
69.246.151.5:443
5.2.149.216:443
24.168.237.215:443
173.173.68.41:443
98.213.28.175:443
195.162.106.93:2222
72.218.167.183:995
82.210.157.185:443
86.189.181.83:443
86.122.235.58:443
68.204.164.222:443
89.35.93.244:443
87.65.204.240:995
86.125.196.123:443
73.214.231.2:443
201.152.164.85:995
174.60.164.63:443
78.97.27.28:443
73.23.77.142:443
86.123.130.104:443
69.202.163.99:443
93.118.90.70:2222
73.23.194.75:443
108.56.213.203:443
108.227.161.27:995
104.36.135.227:443
66.208.105.6:443
188.240.233.107:995
217.162.149.212:443
74.194.4.181:443
65.116.179.83:443
174.130.226.180:443
35.142.24.147:2222
207.155.106.187:443
5.2.240.136:443
156.96.45.215:443
24.37.178.158:990
108.30.161.143:443
47.222.40.131:443
71.193.126.206:443
98.243.187.85:443
24.44.180.236:2222
50.29.166.232:995
73.32.109.26:443
72.132.21.151:443
47.40.244.237:443
70.174.3.241:443
70.120.149.173:443
188.26.244.47:443
137.99.224.198:443
79.113.215.65:443
79.118.4.36:443
98.199.226.41:443
24.212.149.77:443
188.50.180.47:995
108.190.151.108:2222
207.144.193.210:443
172.78.87.180:443
94.52.124.226:443
81.103.144.77:443
24.37.178.158:995
68.14.210.246:22
95.77.223.148:443
151.205.102.42:443
Signatures
-
Qakbot family
Files
-
49306264f814120088dd56af325db4f43ef3a0142b18ce482d021ae098d776e0.exe windows x86
3489ec6897bf25dd7f5d86ee09369d0d
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
userenv
GetUserProfileDirectoryW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitialize
CoInitializeSecurity
shell32
CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW
setupapi
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
kernel32
GetLastError
GetProcAddress
LoadLibraryA
lstrcmpiW
GetModuleHandleA
CloseHandle
GetCurrentProcessId
GetEnvironmentVariableW
lstrlenA
WideCharToMultiByte
lstrcatA
GetEnvironmentVariableA
MultiByteToWideChar
lstrlenW
lstrcatW
lstrcpyA
HeapAlloc
HeapFree
HeapCreate
VirtualAlloc
GetFileSize
lstrcmpiA
GetModuleFileNameA
FindResourceA
LoadResource
SizeofResource
GetThreadContext
CreateEventA
GetModuleHandleW
LoadLibraryW
TerminateProcess
DeleteFileW
ResumeThread
ExpandEnvironmentStringsW
GetComputerNameW
GetVolumeInformationW
ReleaseMutex
GetExitCodeProcess
GetSystemTimeAsFileTime
SetEnvironmentVariableW
GetTickCount
GetModuleFileNameW
GetSystemInfo
SetEnvironmentVariableA
GetVersionExA
CopyFileW
SetEvent
OpenEventA
CreateMutexA
TerminateThread
CreateThread
GetFileAttributesA
GetFileAttributesW
GetCurrentThread
LocalAlloc
GetLocalTime
LocalFree
lstrcpyW
CreateDirectoryW
SleepEx
WaitForSingleObject
FreeLibrary
GetDriveTypeW
lstrcmpA
GetCommandLineW
ExitProcess
lstrcpynW
Sleep
SystemTimeToFileTime
GetSystemTime
GetCurrentProcess
GetWindowsDirectoryW
user32
CharUpperBuffA
MessageBoxA
GetClassNameA
CharUpperBuffW
advapi32
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
LookupAccountNameW
EqualSid
SetServiceStatus
RegUnLoadKeyW
RegLoadKeyW
ConvertSidToStringSidW
RegSetValueExW
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegCloseKey
SetFileSecurityW
OpenProcessToken
GetSidSubAuthority
OpenThreadToken
GetSidSubAuthorityCount
LookupAccountSidW
CreateProcessAsUserW
msvcrt
memcpy
memset
_vsnwprintf
_vsnprintf
_except_handler3
_ltoa
netapi32
NetApiBufferFree
NetUserEnum
NetGetDCName
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ