Behavioral task
behavioral1
Sample
1836-61-0x00000000001D0000-0x00000000001F2000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1836-61-0x00000000001D0000-0x00000000001F2000-memory.dll
Resource
win10v2004-20220901-en
General
-
Target
1836-61-0x00000000001D0000-0x00000000001F2000-memory.dmp
-
Size
136KB
-
MD5
bd7e786c8538b9aae0c7ae337709a643
-
SHA1
8ad1b902323a847e2e7c13787f8b477cca44da4e
-
SHA256
59caa3741d10b75f4351183362e4ad98dab0c2700339355f1283ed9724dd6030
-
SHA512
16f6e09ac8567e1b03545607d031a69a68a8200ae6aa7a6cde123b3adadf4885275e7b80903fecf7cf70210e14838c9b6c4915a568aa9f0e3b745634220d438f
-
SSDEEP
3072:cHI+ct60UvCXZecOLbAQPJ2i1BwTBfZWYyR:sJfqXZec6MQPJj1BwTBxdyR
Malware Config
Extracted
qakbot
403.914
obama210
1665041236
41.104.205.128:443
134.35.6.76:443
197.202.163.4:443
181.164.194.228:443
105.159.124.224:443
197.158.89.85:443
41.96.33.236:443
181.141.3.126:443
123.22.7.132:443
163.182.177.80:443
41.248.72.229:8443
41.100.62.129:443
68.83.169.91:443
190.29.228.61:443
160.176.249.11:995
41.107.54.99:443
94.52.127.44:443
105.69.155.85:995
45.227.251.167:2222
197.206.141.97:443
149.126.159.254:443
181.44.34.172:443
81.184.181.215:443
148.213.109.165:995
105.111.44.93:443
42.189.12.36:80
72.88.245.71:443
181.114.169.156:443
98.143.70.147:2222
197.94.70.41:443
197.11.134.255:443
197.204.247.7:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot family
Files
-
1836-61-0x00000000001D0000-0x00000000001F2000-memory.dmp.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ