Behavioral task
behavioral1
Sample
1808-57-0x0000000000170000-0x0000000000192000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1808-57-0x0000000000170000-0x0000000000192000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1808-57-0x0000000000170000-0x0000000000192000-memory.dmp
-
Size
136KB
-
MD5
e7712e5f85e341fca260f0532e25e378
-
SHA1
5635fb4834bca1bd81c01ffa947af4e1c141a638
-
SHA256
b1f948218b9239ee662bb8beaedcabd568fbce71bd242aa56c3d393ea241632b
-
SHA512
f67be5817fe790068cba5faeb792e4719d3491053328f6570067f509227b618c02f238797379b68e218e8b989e26a365d6ba4f38693034d9fb97b76ad7d5c737
-
SSDEEP
3072:kf0SYtA9nahTpwx+CRA4vJkE96MTBfNwYin:kf39ahTpwta4vJn96MTBlDin
Malware Config
Extracted
qakbot
78.94.148.92:1753
134.180.185.240:32987
201.136.101.182:38323
124.77.95.5:46163
196.90.29.190:30693
187.144.110.117:36330
10.44.33.140:65267
162.117.200.91:29984
159.254.223.192:31154
11.239.81.233:37
31.248.76.23:24072
224.77.182.18:55579
124.230.27.11:44408
205.255.39.94:54675
192.1.213.104:14212
145.3.120.239:20068
242.199.30.106:9157
243.240.195.106:42825
74.234.32.185:42698
102.51.5.67:47820
43.190.241.127:50708
29.119.168.182:51370
54.106.172.208:21101
76.55.174.209:2746
71.182.193.130:5327
111.143.132.167:9985
173.210.161.232:27188
22.155.219.162:29117
167.159.67.2:42455
80.214.112.151:9618
75.86.4.24:35165
106.146.239.56:49679
194.127.196.112:59762
64.184.233.29:48193
218.86.11.123:62100
108.87.254.103:36138
240.129.151.227:4400
96.117.66.72:0
48.220.224.248:32917
240.164.22.246:57048
224.87.85.180:40164
214.9.213.13:12523
117.180.92.184:46633
73.23.253.56:17393
162.74.55.118:4571
9.252.189.253:60714
101.200.152.191:46287
110.117.95.0:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot family
Files
-
1808-57-0x0000000000170000-0x0000000000192000-memory.dmp.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ