Behavioral task
behavioral1
Sample
1416-60-0x00000000001F0000-0x0000000000212000-memory.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1416-60-0x00000000001F0000-0x0000000000212000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1416-60-0x00000000001F0000-0x0000000000212000-memory.dmp
-
Size
136KB
-
MD5
9c632537243231fd36404280c598f07b
-
SHA1
39e71eac102bac1b7f1d2a2b6e5bcbb9ea410bb7
-
SHA256
edd3af3965a7028935f6a01ca8e74553010e6684a832a326555680dd3a8d6ec4
-
SHA512
85a5a43c32063e2eba3ef4b686d674cdf2a37cb97e8b5a4cffd4a01c78a46b102da741230f352b536c569e17f4ab878feef4cfe0ad6f8c338fbc0a6821e7029d
-
SSDEEP
1536:y24iKb4EzwCy0MVrSqilhSVAYFVmHJBAaktJJBlzpkIOYnToIfNW1CmNvqHu:ZIz8nSqilo6YF4HjAJJDltK8TBfNpyH
Malware Config
Extracted
qakbot
99.221.33.122:35602
29.202.180.222:51620
23.94.40.182:4331
34.19.16.166:1288
241.163.135.223:50051
32.107.156.85:19172
228.49.142.11:64889
196.202.140.31:7400
110.114.87.194:23019
217.188.119.28:9613
29.44.169.79:27952
169.83.63.109:46511
47.65.80.200:49855
50.140.194.100:14738
152.64.159.219:41214
12.255.117.222:36282
199.246.11.177:40851
81.180.116.241:1057
87.3.215.226:21496
247.44.83.206:32161
110.141.155.115:21355
126.7.15.81:38878
246.166.147.15:42079
71.118.48.68:16876
240.237.58.79:52135
228.135.88.101:8170
37.13.235.189:18671
187.156.210.204:4243
146.54.170.64:61188
240.132.30.162:19966
23.207.217.71:260
125.250.215.162:30167
242.193.131.8:56589
188.7.186.109:6729
80.147.52.103:32403
232.222.181.12:36938
165.107.195.136:37237
193.129.246.98:0
162.224.55.111:30915
17.105.54.14:63284
149.253.253.235:19955
148.219.182.10:5489
56.214.171.2:7637
171.182.161.115:60821
175.2.110.61:49611
99.130.91.79:29604
136.197.36.254:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot family
Files
-
1416-60-0x00000000001F0000-0x0000000000212000-memory.dmp.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ