General

  • Target

    pdijo.dll

  • Size

    151KB

  • MD5

    dc7093386557fbb211e1a86b557f74ae

  • SHA1

    3d85bcac03dbafee648c2c249853e1dd080948ea

  • SHA256

    9fc17f95f1af10a43fd22575bb85d72050a74b19fc8a7e2465237de58594394a

  • SHA512

    09b88b6893c3951daccf2668e812dee5f2bd9f44fbc582b538b6884e7bebb00fa7dac6bda10332f153b93d46b855ef73302819be33afe9dd9ddae159024a4282

  • SSDEEP

    1536:C9exXW5vmCJMaawKuDiXRHdtJAJBAitgJUOpKYJIOcnToIfpx/0ad7aomtC6:CQAyTwKCQRHLajAVJTpzjwTBfpVol

Malware Config

Extracted

Family

qakbot

Version

403.892

Botnet

obama203

Campaign

1663242106

C2

81.131.161.131:2078

217.165.85.223:993

37.210.148.30:995

200.161.62.126:32101

78.100.225.34:2222

119.82.111.158:443

66.181.164.43:443

134.35.13.45:443

193.3.19.37:443

99.232.140.205:2222

197.94.210.133:443

87.243.113.104:995

84.38.133.191:443

14.184.97.67:443

123.240.131.1:443

194.166.207.160:995

78.168.87.170:2222

180.180.131.95:443

41.96.56.224:443

190.44.40.48:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Files

  • pdijo.dll
    .dll regsvr32 windows x86

    0ca0c58d9f3aa629bfca28a0bff008e3


    Headers

    Imports

    Exports

    Sections