DllInstall
DllRegisterServer
HiefplnBaydof
General
-
Target
9e019be3674a2ee8b9d5353cdb153a21f240e9cc3b0ffedf3cfc43b27c599da5.bin
-
Size
128KB
-
MD5
b3294e46012334c0add833b92788db71
-
SHA1
5ece37bc9f5b876779d13069a0b35dd12806c17d
-
SHA256
9e019be3674a2ee8b9d5353cdb153a21f240e9cc3b0ffedf3cfc43b27c599da5
-
SHA512
f5a562129371137f22584d4ada59a2d65fc62db69d4b4ed3202eff2c9864fff2705a4da04b27abe03b5541c87c67b46bbb364127dd333601c14bb833011dc714
-
SSDEEP
3072:VV9GWm/WPuPuZji5rPSASJDgfMBTBfQIOBMh:Pm/WGPuZj83SJEfMBTBoIO0
Score
10/10
Malware Config
Extracted
Family
qakbot
Version
403.780
Botnet
obama201
Campaign
1657815129
C2
70.46.220.114:443
179.111.8.52:32101
208.107.221.224:443
176.45.218.138:995
24.158.23.166:995
24.54.48.11:443
89.101.97.139:443
24.55.67.176:443
24.139.72.117:443
120.150.218.241:995
174.69.215.101:443
38.70.253.226:2222
41.228.22.180:443
217.165.157.202:995
172.115.177.204:2222
173.21.10.71:2222
69.14.172.24:443
47.23.89.60:993
104.34.212.7:32103
66.230.104.103:443
81.158.239.251:2078
179.158.105.44:443
189.253.167.141:443
24.178.196.158:2222
174.80.15.101:2083
187.116.126.216:32101
100.38.242.113:995
74.14.5.179:2222
40.134.246.185:995
172.114.160.81:443
72.252.157.93:995
70.51.137.244:2222
82.41.63.217:443
197.89.11.218:443
37.34.253.233:443
67.209.195.198:443
67.165.206.193:993
93.48.80.198:995
111.125.245.116:995
1.161.118.53:443
76.25.142.196:443
148.64.96.100:443
217.128.122.65:2222
32.221.224.140:995
47.180.172.159:443
39.57.56.11:995
186.90.153.162:2222
37.186.58.99:995
86.97.10.37:443
39.44.116.107:995
182.191.92.203:995
86.98.78.118:993
117.248.109.38:21
39.52.44.132:995
1.161.118.53:995
91.75.85.128:1194
121.7.223.45:2222
39.41.90.210:995
46.107.48.202:443
190.252.242.69:443
187.172.31.52:443
72.252.157.93:993
72.252.157.93:990
47.145.130.171:443
63.143.92.99:995
197.92.136.122:443
45.46.53.140:2222
196.203.37.215:80
94.59.138.43:2222
92.132.132.81:2222
39.49.48.167:995
103.246.242.202:443
84.241.8.23:32103
94.59.15.180:2222
89.211.209.234:2222
94.36.193.176:2222
47.156.129.52:443
201.172.20.105:2222
109.12.111.14:443
85.6.232.221:2222
96.37.113.36:993
2.178.120.112:61202
193.136.1.58:443
103.133.11.10:995
120.61.3.142:443
182.52.159.24:443
78.100.219.38:50010
173.174.216.62:443
106.51.48.188:50001
67.69.166.79:2222
45.241.254.69:993
88.240.59.52:443
86.213.75.30:2078
24.43.99.75:443
101.50.67.155:995
108.56.213.219:995
5.32.41.45:443
39.53.139.2:995
80.11.74.81:2222
Attributes
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot family
Files
-
9e019be3674a2ee8b9d5353cdb153a21f240e9cc3b0ffedf3cfc43b27c599da5.bin.dll regsvr32 windows x86
0ac722e57c2c4e9d17a175801fddbcc5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_snprintf
_errno
_strtoi64
_vsnprintf
memchr
memset
free
_vsnwprintf
qsort
malloc
_time64
strncpy
strchr
strtod
localeconv
_ftol2_sse
atol
memcpy
kernel32
GetTickCount
GetModuleHandleA
GetWindowsDirectoryW
GetCurrentDirectoryW
GetSystemInfo
GetVersionExA
GetCommandLineW
LoadLibraryW
FlushFileBuffers
LocalAlloc
CreateMutexW
DuplicateHandle
GetCurrentThread
lstrcmpA
GetLastError
lstrcatA
CreateDirectoryW
DisconnectNamedPipe
lstrcpynW
GetProcessId
lstrlenW
lstrcatW
lstrcpyW
GetOEMCP
GetFileAttributesW
lstrcmpiW
GetDriveTypeW
K32GetModuleFileNameExW
MoveFileW
lstrcpynA
GetCurrentProcessId
SwitchToThread
GetModuleHandleW
GetProcAddress
HeapCreate
HeapFree
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
FreeLibrary
lstrcmpiA
GetSystemTimeAsFileTime
SetThreadPriority
SetFileAttributesW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
user32
DefWindowProcW
UnregisterClassA
RegisterClassExA
CharUpperBuffW
CharUpperBuffA
CreateWindowExA
DestroyWindow
shell32
CommandLineToArgvW
ole32
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
oleaut32
SafeArrayGetElement
SafeArrayGetLBound
SysFreeString
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayGetUBound
Exports
Exports
Sections
.text Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ