qakbot | 1188-60-0x00000000001D0000-0x0000000000250000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1188-60-0x00000000001D0000-0x0000000000250000-memory.dmp
Size

512KB
MD5

28df75d67eacbff3895584d5d276a1c1
SHA1

813933793823186b74a7cc9cc0e2134cca3ec214
SHA256

f11448eed850568a4084bdefdd7f9602516793418eb5164d98f834acae5d5fb2
SHA512

b52552440fb10e52677736be23c536e398bed1fb05979de1dfa18af973ab90d0bb308fe08d376322b6b745a1a435478a12ec8d066b4d33037138fc6d28422626
SSDEEP

6144:KB6qngWYK5nJJ1IITBuYLe3r+ef/RlGhsKuF8ySFlLE2PnFWAbIHCtgnekY7ae8w:egWYKxJzIITAlGhRcf/3HCty8H4bcd

Score

10^/10

qakbot

Malware Config

Signatures

Qakbot family
qakbot

Files

1188-60-0x00000000001D0000-0x0000000000250000-memory.dmp
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ