Static task
static1
Behavioral task
behavioral1
Sample
16a6cc139dbc41cff9f775238f5a111962824745adcd0d746ee68fe1b793f446.exe
Resource
win7-20220414-en
General
-
Target
16a6cc139dbc41cff9f775238f5a111962824745adcd0d746ee68fe1b793f446
-
Size
221KB
-
MD5
93a1498df07b4d368895de25c32be22e
-
SHA1
cd4ec1f2efc6cc9474777a37ee9743681ac6a94a
-
SHA256
16a6cc139dbc41cff9f775238f5a111962824745adcd0d746ee68fe1b793f446
-
SHA512
b3486e1380aab5d30d5a44fa4d61aa12da8229929fadf9021cf3b89536f9d564bee648c0ad6b8680fb05ad4edb46785d65b8945c4f54311b0930ebafec911ba2
-
SSDEEP
3072:9J8CJhlj2Dvt8Hd08BxIV5jSsYbP4VtynpB2igfWhG3jPl2te:9iCJP2aHF2rQ4HyeigOUzU
Malware Config
Extracted
qakbot
324.75
spx89
1585917777
66.44.96.184:443
185.145.113.249:443
87.65.204.240:995
68.174.9.179:443
97.127.144.203:2222
76.180.69.236:443
24.234.86.201:995
188.173.185.139:443
83.25.10.201:2222
93.114.115.146:443
24.201.79.208:2078
65.116.179.83:443
5.70.173.217:443
207.155.106.187:443
5.14.187.133:443
73.163.242.114:443
84.117.60.157:443
90.192.191.3:443
100.33.132.135:443
96.232.203.15:443
71.217.112.41:2222
72.255.200.129:2222
81.106.46.63:443
188.27.17.115:443
78.96.177.188:443
173.175.29.210:443
47.41.3.40:443
68.39.207.79:443
68.82.125.234:443
24.26.1.14:2222
206.183.190.53:995
86.124.109.100:443
97.96.51.117:443
68.98.142.248:443
73.111.224.222:443
188.25.93.249:443
184.13.73.135:443
187.163.101.137:995
86.122.236.97:443
86.123.95.59:2222
95.77.237.115:443
120.147.65.97:2222
75.130.117.134:443
95.77.144.238:443
24.55.152.50:995
71.77.231.251:443
63.155.135.211:995
73.184.218.146:443
39.59.82.73:995
181.197.195.138:995
72.36.59.46:2222
174.60.164.63:443
79.119.248.1:443
84.247.55.190:443
98.243.187.85:443
98.215.176.247:443
69.202.163.99:443
72.90.243.117:0
73.23.194.75:443
24.228.7.174:443
79.113.173.185:443
71.221.224.19:2222
70.183.127.6:995
79.114.194.106:443
5.182.39.156:443
24.110.96.149:443
174.126.230.25:443
75.110.250.89:443
24.184.5.251:2222
86.189.181.83:443
173.22.120.11:2222
71.11.209.101:443
73.169.47.57:443
24.46.40.189:2222
46.214.69.150:443
75.110.93.212:443
70.57.15.187:993
72.190.124.29:443
74.102.83.89:443
23.24.115.181:443
73.214.231.2:443
72.16.212.107:465
173.3.132.17:995
24.229.245.124:995
49.191.6.183:995
47.205.231.60:443
98.204.224.168:995
70.62.160.186:6883
71.187.170.235:443
85.7.22.186:2222
96.35.170.82:2222
72.142.106.198:465
46.214.62.199:443
68.200.184.210:995
24.202.42.48:2222
108.54.103.234:443
72.80.137.215:443
94.52.160.218:443
70.74.159.126:2222
201.152.203.196:995
172.95.42.35:443
216.201.162.158:443
98.219.77.197:443
108.30.161.143:443
31.5.189.71:443
69.92.54.95:995
108.190.151.108:2222
89.46.27.192:443
71.213.61.215:995
96.248.125.34:443
75.81.25.223:995
47.153.115.154:995
72.38.44.119:995
67.250.184.157:443
151.205.102.42:443
47.153.115.154:443
96.234.20.230:443
173.62.161.126:443
73.101.211.117:443
71.77.252.14:2222
190.136.118.156:443
108.27.217.44:443
173.79.220.156:443
46.214.86.45:443
208.126.142.17:443
66.222.88.126:995
46.153.111.112:995
104.36.135.227:443
70.95.94.91:2078
190.133.53.89:995
68.49.120.179:443
188.25.237.208:443
68.204.164.222:443
79.114.2.187:443
213.31.203.38:2222
5.12.213.152:2222
81.133.234.36:2222
46.228.183.228:443
50.29.181.193:995
95.76.187.199:443
75.182.220.196:2222
121.122.66.130:443
5.13.126.243:443
66.26.160.37:443
72.132.249.144:995
74.33.70.220:443
98.199.226.41:443
68.46.142.48:995
70.126.76.75:443
86.123.17.28:443
Signatures
-
Qakbot family
Files
-
16a6cc139dbc41cff9f775238f5a111962824745adcd0d746ee68fe1b793f446.exe windows x86
3489ec6897bf25dd7f5d86ee09369d0d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
userenv
GetUserProfileDirectoryW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitialize
CoInitializeSecurity
shell32
CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW
setupapi
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
kernel32
GetLastError
GetProcAddress
LoadLibraryA
lstrcmpiW
GetModuleHandleA
CloseHandle
GetCurrentProcessId
GetEnvironmentVariableW
lstrlenA
WideCharToMultiByte
lstrcatA
GetEnvironmentVariableA
MultiByteToWideChar
lstrlenW
lstrcatW
lstrcpyA
HeapAlloc
HeapFree
HeapCreate
VirtualAlloc
GetFileSize
lstrcmpiA
GetModuleFileNameA
FindResourceA
LoadResource
SizeofResource
GetThreadContext
CreateEventA
GetModuleHandleW
LoadLibraryW
TerminateProcess
DeleteFileW
ResumeThread
ExpandEnvironmentStringsW
GetComputerNameW
GetVolumeInformationW
ReleaseMutex
GetExitCodeProcess
GetSystemTimeAsFileTime
SetEnvironmentVariableW
GetTickCount
GetModuleFileNameW
GetSystemInfo
SetEnvironmentVariableA
GetVersionExA
CopyFileW
SetEvent
OpenEventA
CreateMutexA
TerminateThread
CreateThread
GetFileAttributesA
GetFileAttributesW
GetCurrentThread
LocalAlloc
GetLocalTime
LocalFree
lstrcpyW
CreateDirectoryW
SleepEx
WaitForSingleObject
FreeLibrary
GetDriveTypeW
lstrcmpA
GetCommandLineW
ExitProcess
lstrcpynW
Sleep
SystemTimeToFileTime
GetSystemTime
GetCurrentProcess
GetWindowsDirectoryW
user32
CharUpperBuffA
MessageBoxA
GetClassNameA
CharUpperBuffW
advapi32
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
LookupAccountNameW
EqualSid
SetServiceStatus
RegUnLoadKeyW
RegLoadKeyW
ConvertSidToStringSidW
RegSetValueExW
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegCloseKey
SetFileSecurityW
OpenProcessToken
GetSidSubAuthority
OpenThreadToken
GetSidSubAuthorityCount
LookupAccountSidW
CreateProcessAsUserW
msvcrt
memcpy
memset
_vsnwprintf
_vsnprintf
_except_handler3
_ltoa
netapi32
NetApiBufferFree
NetUserEnum
NetGetDCName
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ