Overview

overview

10

Static

static

10

1980-57-0x...ry.dll

windows7_x64

1

1980-57-0x...ry.dll

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1980-57-0x0000000000730000-0x0000000000752000-memory.dmp

  • Size

    136KB

  • Sample

    220525-rhb8aabbh4

  • MD5

    babf45c7aee63f8bae233930b60b1954

  • SHA1

    eaf8fb653cced1fe1c1dfbc0391da803181a83a2

  • SHA256

    b471df54b302050065ebc380e20cf88b51e8ed9d61911c1eb3a2fec108c4e236

  • SHA512

    d6ff63cec10ef36082eaf4b85a11d83888eb6fbd4cba3c18a2a22683e1240f448e45a845ea52ce3f268ff488414981915e55df6245bedbec77b681eb0f007df2

Score
10/10
qakbotaa1653399733

Malware Config

Extracted

Family

qakbot

Version

403.690

Botnet

AA

Campaign

1653399733

C2

1.161.104.31:443

47.156.131.10:443

201.172.23.68:2222

187.251.132.144:22

31.215.69.176:443

191.250.188.54:443

93.48.80.198:995

80.11.74.81:2222

38.70.253.226:2222

100.1.108.246:443

5.32.41.45:443

188.161.200.40:995

201.242.206.44:2222

208.107.221.224:443

47.23.89.60:993

75.99.168.194:443

103.246.242.202:443

200.148.9.225:32101

37.210.169.150:2222

79.129.121.68:995
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      1980-57-0x0000000000730000-0x0000000000752000-memory.dmp

    • Size

      136KB

    • MD5

      babf45c7aee63f8bae233930b60b1954

    • SHA1

      eaf8fb653cced1fe1c1dfbc0391da803181a83a2

    • SHA256

      b471df54b302050065ebc380e20cf88b51e8ed9d61911c1eb3a2fec108c4e236

    • SHA512

      d6ff63cec10ef36082eaf4b85a11d83888eb6fbd4cba3c18a2a22683e1240f448e45a845ea52ce3f268ff488414981915e55df6245bedbec77b681eb0f007df2

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks