Behavioral task
behavioral1
Sample
4916-136-0x0000000001150000-0x0000000001179000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4916-136-0x0000000001150000-0x0000000001179000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
4916-136-0x0000000001150000-0x0000000001179000-memory.dmp
-
Size
164KB
-
MD5
46cde508fd9f00e0201d230cb49eeb8c
-
SHA1
07370e7d1f9b59aa0dec9f5d126941aec50d20d2
-
SHA256
dec974f46b1f20065377419c3b906066be1ee32abfab8f8cb187c9c4662f638c
-
SHA512
7b0682fb000644e444f97ef4f999595576bbb494f8d363b3566679740c764a6a4f848188680c1d933a070199fc3dfb86059ad8e3aa88a0da13f6a5aa1e55a52f
-
SSDEEP
3072:bzQazYYCn1fU6IABVJ2z/DjTBf5gyHeO/ya:/zZCn1PN/Je/DjTBxfHB/
Malware Config
Extracted
qakbot
403.1051
BB04
1666690935
181.164.194.228:443
24.116.45.121:443
190.74.248.136:443
24.206.27.39:443
27.110.134.202:995
2.88.206.121:443
71.199.168.185:443
200.233.108.153:995
198.2.51.242:993
172.117.139.142:995
70.115.104.126:443
144.202.15.58:443
190.24.45.24:995
24.9.220.167:443
58.247.115.126:995
193.3.19.137:443
45.230.169.132:995
68.62.199.70:443
43.241.159.238:443
113.162.196.232:443
156.217.60.239:995
197.204.70.167:443
201.68.209.47:32101
190.33.241.216:443
156.197.230.148:995
197.202.196.43:443
175.205.2.54:443
24.130.228.100:443
41.109.228.108:995
64.123.103.123:443
190.193.180.228:443
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
206.1.164.250:443
190.36.189.34:993
173.49.74.62:443
41.99.110.44:443
190.203.51.133:2222
174.29.45.113:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.111.81.57:443
105.158.78.171:443
24.207.97.117:443
88.240.75.201:443
105.154.214.130:995
41.104.155.245:443
41.98.242.254:443
196.70.146.120:443
90.165.109.4:2222
75.84.234.68:443
65.140.11.170:443
186.154.189.162:995
191.96.67.93:995
151.213.183.141:995
184.159.76.47:443
105.98.223.169:443
190.201.145.155:443
197.0.225.39:443
78.179.135.247:443
197.2.193.4:995
152.170.17.136:443
191.33.187.192:2222
41.101.193.38:443
105.156.0.235:995
98.207.190.55:443
41.47.249.185:443
186.18.210.16:443
196.207.146.151:443
118.174.207.134:995
47.14.229.4:443
41.234.116.241:993
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
167.58.254.85:443
186.18.77.99:443
41.107.78.169:443
102.159.194.141:443
149.126.159.224:443
201.208.58.92:2222
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.222.56:2087
102.156.162.83:443
220.134.54.185:2222
190.37.174.11:2222
176.241.48.177:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443
42.116.54.220:443
197.244.204.128:443
190.203.106.109:2222
200.155.61.245:995
200.155.61.245:443
105.105.46.239:443
200.233.108.153:993
41.143.109.111:61202
91.171.72.214:32100
136.232.184.134:995
186.52.96.202:995
163.182.177.80:443
167.56.53.143:995
181.141.3.126:443
189.216.29.135:443
191.84.65.116:443
186.14.70.229:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot family
Files
-
4916-136-0x0000000001150000-0x0000000001179000-memory.dmp.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ