Behavioral task
behavioral1
Sample
3680-133-0x0000000000FC0000-0x0000000000FE2000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3680-133-0x0000000000FC0000-0x0000000000FE2000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
3680-133-0x0000000000FC0000-0x0000000000FE2000-memory.dmp
-
Size
136KB
-
MD5
3d80fbb9d7eacb6dded013738abdacf2
-
SHA1
cb2fc11076fa7c8265ac29f3cfe35b7863c85847
-
SHA256
afc06ed88010e1a2a2b60adcb95c25c1bee71cf7b61d09ec4fd49dcfab294b17
-
SHA512
84c3d2004c323652c703ef46c6ece1671b223cc3d3ad2bdaba2c7622e589f9a04b340bb2b7fd667d0899918757b3b589721872dc285c73701c4974e764001207
-
SSDEEP
1536:O5t669fQhfCQLD4UTqdnISVzLvE0BA4rrzkJpCCGURIO0nToIfpZBCmNgqHu:O58HgKqdISVzTEMAjJ0Cr7YTBfpqiO
Malware Config
Extracted
qakbot
75.116.87.44:14933
64.55.103.194:9151
80.214.68.88:40730
97.184.129.40:2118
216.44.143.70:26851
239.39.127.10:38876
57.33.10.57:17737
201.128.252.151:58865
211.76.239.250:34506
124.58.65.86:13247
41.8.154.58:7614
6.55.240.195:27003
139.242.121.12:23370
8.81.30.103:64297
168.13.24.67:37382
17.219.125.20:59669
136.66.66.194:40287
63.172.177.141:57252
195.44.25.26:29277
67.212.106.154:59890
149.254.111.67:39052
184.74.22.12:50436
166.33.149.229:19515
172.102.164.60:43562
155.28.49.2:51545
7.122.114.191:33775
220.68.130.196:7948
121.236.113.177:14197
47.2.191.47:32393
49.93.218.109:41033
174.124.34.188:14831
178.143.168.245:48707
159.196.166.193:58136
1.104.105.37:49572
225.108.223.250:46683
105.208.24.120:59473
180.179.25.125:42514
236.83.216.21:0
90.29.227.242:1085
212.204.93.86:48405
115.34.223.65:24926
250.151.244.173:3488
16.95.145.59:42025
50.6.212.181:17804
23.86.160.130:53103
212.133.85.240:62503
122.125.236.31:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot family
Files
-
3680-133-0x0000000000FC0000-0x0000000000FE2000-memory.dmp.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ