qakbot | 567f202dfc1e9a05edbb050c9fddae3bd8dfa3e3f728e29941bd8fa480397bf2

Sharing

Copy URL Twitter E-mail

General

Target

567f202dfc1e9a05edbb050c9fddae3bd8dfa3e3f728e29941bd8fa480397bf2
Size

126KB
MD5

c29dab355881806a92acd0f3ed8e9065
SHA1

cc17d872198d65d8cc77f947cdfeacbfc08d397c
SHA256

567f202dfc1e9a05edbb050c9fddae3bd8dfa3e3f728e29941bd8fa480397bf2
SHA512

21ae5291862ae7650ab4254846989e854667c109c7e430130d422cbaf895c7f281979c794ec5b00ae28c89fda18128510b81f9d3f6d630b9597524c07bed1429
SSDEEP

3072:WPCoBOaicqhHK3astDytn1Y/p6oD0NTBfJNmJ:WP8xhHK37tDqW/pZD0NTBhNm

Score

10^/10

qakbot

Malware Config

Signatures

Qakbot family
qakbot

Files

567f202dfc1e9a05edbb050c9fddae3bd8dfa3e3f728e29941bd8fa480397bf2
.dll regsvr32 windows x86

3be95fff18553fbe7f242ae5c250e253

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

localeconv
atol
memcpy
strtod
strchr
_ftol2_sse
_vsnwprintf
_vsnprintf
qsort
_snprintf
_errno
_strtoi64
memchr
memset
free
malloc
_time64
strncpy

kernel32

MoveFileW
lstrcatA
CreateMutexW
DuplicateHandle
GetCurrentThread
K32GetModuleFileNameExW
lstrcmpA
GetProcessId
lstrcpynA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
HeapCreate
HeapFree
HeapAlloc
FindFirstFileW
FindNextFileW
SetFileAttributesW
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcmpiW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetExitCodeProcess
GetModuleHandleA
LocalAlloc
GetWindowsDirectoryW
FlushFileBuffers
SetThreadPriority
GetCommandLineW
GetVersionExA
GetSystemInfo
GetCurrentDirectoryW
LoadLibraryW
GetTickCount
GetFileAttributesW
GetModuleHandleW
GetOEMCP
DisconnectNamedPipe
lstrcpyW
lstrcatW
GetLastError
lstrcpynW
CreateDirectoryW
SwitchToThread
GetDriveTypeW
lstrcmpiA

gdi32

SelectObject
CreateCompatibleDC
BitBlt
GetDeviceCaps
DeleteDC
GetObjectW
GetDIBits
CreateCompatibleBitmap
DeleteObject

ole32

CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

user32

RegisterClassExA
UnregisterClassA
CreateWindowExA
GetDC
CharUpperBuffA
DrawIconEx
GetCursorInfo
CopyIcon
CharUpperBuffW
DefWindowProcW
GetIconInfo
DestroyWindow

shell32

CommandLineToArgvW

oleaut32

SafeArrayGetElement
SafeArrayGetLBound
SysFreeString
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayGetUBound

Exports

Exports

DllInstall
DllRegisterServer

Sections

.text
Size: 95KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3be95fff18553fbe7f242ae5c250e253

Headers

File Characteristics

Imports

msvcrt

kernel32

gdi32

ole32

user32

shell32

oleaut32

Exports

Exports

Sections

.text Size: 95KB - Virtual size: 96KB

.rdata Size: 18KB - Virtual size: 20KB

.data Size: 6KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 95KB - Virtual size: 96KB

.rdata
Size: 18KB - Virtual size: 20KB

.data
Size: 6KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 3KB