Behavioral task
behavioral1
Sample
1428-57-0x00000000002C0000-0x00000000002E2000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1428-57-0x00000000002C0000-0x00000000002E2000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1428-57-0x00000000002C0000-0x00000000002E2000-memory.dmp
-
Size
136KB
-
MD5
5ba5635a9c22a6ce961fcf125f64c929
-
SHA1
4bb35fc5d12bec140ba42e203b610da309c8a9f6
-
SHA256
2b2dc8084869cd41ab113b0e9ccb35917caa3e5893afcab51ccc1d5520acc964
-
SHA512
a93f7f1ccb229de74333a3ddd37dc054c1997f1898c656d4016a9c2f9013c191bde4326edbcfa20ec8a3c57f83ea639cf2c6e0e355dbe7e6f8d03b2a1bf65e2b
-
SSDEEP
3072:zShcwKsDenDDFK+nicxvim5lfp6ACPJP7r+YTBfJNY7+7:zceum5lxvCPJTr+YTBhC7+7
Malware Config
Extracted
qakbot
221.44.158.12:15899
135.59.24.163:19546
94.7.79.144:54878
227.150.243.114:39154
215.194.96.116:37650
45.64.184.122:25478
85.137.184.169:59234
107.26.25.92:56712
226.156.21.185:57237
29.90.187.89:14834
206.16.38.205:59801
155.151.97.59:36109
47.219.184.104:36930
252.7.46.182:4067
140.243.25.205:24064
94.93.131.253:65187
28.236.43.99:25246
110.175.218.118:43672
159.220.92.54:39126
233.60.229.213:1774
40.238.73.215:25641
168.152.8.85:14726
51.27.237.220:643
38.179.148.136:10087
155.35.214.28:45472
174.73.95.203:57098
253.87.188.28:55082
146.111.123.235:53182
69.139.176.16:5091
174.247.113.60:16625
82.34.204.163:29554
38.149.44.210:27362
75.150.190.231:49453
233.28.178.189:51109
156.55.175.218:18225
226.245.201.147:56691
30.208.231.241:3060
242.154.104.135:0
62.228.78.206:44566
88.203.47.199:48997
23.115.133.62:57748
217.190.219.41:29447
236.129.127.216:10887
179.121.12.220:50554
156.164.32.211:21954
239.86.43.169:5793
139.44.244.27:5564
193.133.234.0:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot family
Files
-
1428-57-0x00000000002C0000-0x00000000002E2000-memory.dmp.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ