Behavioral task
behavioral1
Sample
1704-60-0x0000000000080000-0x00000000000A2000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1704-60-0x0000000000080000-0x00000000000A2000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1704-60-0x0000000000080000-0x00000000000A2000-memory.dmp
-
Size
136KB
-
MD5
75b5ea8e33533b47ee5ca7975a74c0d0
-
SHA1
62b85b2ad0907637a59b08625b061abb076e1cc4
-
SHA256
03cec77e58cc7cb0be12fedad5d6ad375cce4dcaf0aaf555a4f71d57dd126b9b
-
SHA512
bdc219170b4f48e2e5441c57910d8a1f28d6a7841792874b5b524705909228d7265a5048b142aff9c02cdf79deb462616f7567c19af7bdf2a81eced01dd0f031
-
SSDEEP
3072:dc+7eRyKxwqpr2MQgATJ42D+QTBfJuyV:dheRVxrpa1VTJRD+QTBhuyV
Malware Config
Extracted
qakbot
75.116.87.44:14933
64.55.103.194:9151
80.214.68.88:40730
97.184.129.40:2118
216.44.143.70:26851
239.39.127.10:38876
57.33.10.57:17737
201.128.252.151:58865
211.76.239.250:34506
124.58.65.86:13247
41.8.154.58:7614
6.55.240.195:27003
139.242.121.12:23370
8.81.30.103:64297
168.13.24.67:37382
17.219.125.20:59669
136.66.66.194:40287
63.172.177.141:57252
195.44.25.26:29277
67.212.106.154:59890
149.254.111.67:39052
184.74.22.12:50436
166.33.149.229:19515
172.102.164.60:43562
155.28.49.2:51545
7.122.114.191:33775
220.68.130.196:7948
121.236.113.177:14197
47.2.191.47:32393
49.93.218.109:41033
174.124.34.188:14831
178.143.168.245:48707
159.196.166.193:58136
1.104.105.37:49572
225.108.223.250:46683
105.208.24.120:59473
180.179.25.125:42514
236.83.216.21:0
90.29.227.242:1085
212.204.93.86:48405
115.34.223.65:24926
250.151.244.173:3488
16.95.145.59:42025
50.6.212.181:17804
23.86.160.130:53103
212.133.85.240:62503
122.125.236.31:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot family
Files
-
1704-60-0x0000000000080000-0x00000000000A2000-memory.dmp.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ