General

  • Target

    308-58-0x00000000001F0000-0x000000000021A000-memory.dmp

  • Size

    168KB

  • MD5

    673623b4654682896d4adc208bfce714

  • SHA1

    4ce9423d965d5002c88a6103e1b95126be7e608a

  • SHA256

    e9c88cfd8afed2359218e6be480c5a6f83ef62808273cc3d85e37b96570dc60e

  • SHA512

    fe808e7877aa40d16c8e6af2770aacbe82b8a62a1cd561e0f9fe9fbe73f279e99f2fd15c7b6c20b0de40f2be9146499d72ad4b49b2c239188cd3e8c2de85a866

  • SSDEEP

    3072:s/VpdEmPMtlysJX4LvA4Jm6t4UTBfdFg0UO/yaxX1:sz0SsJX4LY4JDt4UTBVFL//

Malware Config

Extracted

Family

qakbot

Version

404.14

Botnet

obama220

Campaign

1667373670

C2

174.0.224.214:443

1.70.60.142:54792

74.33.84.227:443

1.175.205.2:13825

187.1.1.45:12681

190.24.45.24:995

1.50.68.204:18177

193.3.19.137:443

1.41.44.11:58115

73.165.119.20:443

58.247.115.126:995

1.84.35.26:3587

216.82.134.218:443

1.181.164.194:58369

187.1.1.74:23795

71.199.168.185:443

1.94.49.5:29697

187.0.1.108:11471

186.73.140.43:443

1.97.119.214:59649

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Files

  • 308-58-0x00000000001F0000-0x000000000021A000-memory.dmp
    .dll windows x86


    Headers

    Sections