DllInstall
DllRegisterServer
HiefplnBaydof
General
-
Target
d04caa7719610bd0aa0dd1cda75fe73365479b059968b75cf3a9e3fd41ad5ef7.bin
-
Size
126KB
-
MD5
4ca7ff9ea5d5518479d8a2d5e06f3b0e
-
SHA1
d83d333893962698edb9a5a963312cf40815d406
-
SHA256
d04caa7719610bd0aa0dd1cda75fe73365479b059968b75cf3a9e3fd41ad5ef7
-
SHA512
a6926050b57561026546f077b935d694dd0d591ba953b70549c6439fe233c6aa769306a3efa339ad190c052987e719090703cd8527ed7a0f702392110efac875
-
SSDEEP
3072:rV9GWm/WPuPuZji5rPSASJDgfMBTBfQIXMh:Rm/WGPuZj83SJEfMBTBoI+
Score
10/10
Malware Config
Extracted
Family
qakbot
Version
403.780
Botnet
obama194
Campaign
1656313665
C2
70.46.220.114:443
32.221.224.140:995
67.209.195.198:443
186.90.153.162:2222
148.64.96.100:443
67.165.206.193:993
86.200.151.188:2222
80.11.74.81:2222
173.174.216.62:443
45.241.173.232:993
41.228.22.180:443
1.161.81.21:995
24.178.196.158:2222
37.34.253.233:443
93.48.80.198:995
129.208.158.180:995
120.150.218.241:995
38.70.253.226:2222
111.125.245.116:995
47.23.89.60:993
40.134.246.185:995
197.87.144.50:443
217.164.119.69:1194
86.97.10.91:443
39.44.30.209:995
74.14.5.179:2222
182.191.92.203:995
117.248.109.38:21
217.165.97.237:993
84.241.8.23:32103
1.161.81.21:443
24.43.99.75:443
94.59.15.180:2222
121.7.223.45:2222
217.128.122.65:2222
39.41.80.91:995
173.21.10.71:2222
174.69.215.101:443
208.107.221.224:443
45.46.53.140:2222
76.25.142.196:443
81.193.30.90:443
5.32.41.45:443
89.101.97.139:443
109.12.111.14:443
217.164.119.69:2222
69.14.172.24:443
162.252.222.118:443
120.61.2.5:443
90.120.209.197:2078
189.159.2.152:2222
191.112.29.39:443
189.78.107.163:32101
101.50.67.7:995
70.51.132.161:2222
179.158.105.44:443
39.57.60.246:995
184.97.29.26:443
63.143.92.99:995
72.252.157.93:995
190.252.242.69:443
177.45.64.254:32101
24.139.72.117:443
72.252.157.93:993
81.132.186.218:2078
24.55.67.176:443
104.34.212.7:32103
196.203.37.215:80
88.241.122.55:443
39.49.71.64:995
210.246.4.69:995
39.52.114.251:995
193.253.44.249:2222
47.156.129.52:443
72.252.157.93:990
100.38.242.113:995
71.13.93.154:2222
108.60.213.141:443
2.34.12.8:443
187.250.202.2:443
94.36.193.176:2222
89.86.33.217:443
31.215.67.68:2222
188.136.218.225:61202
187.208.115.219:443
191.250.120.152:443
49.128.172.7:2222
91.177.173.10:995
148.0.43.48:443
172.115.177.204:2222
68.204.15.28:443
197.94.94.206:443
87.109.229.215:995
105.247.171.130:995
81.250.191.49:2222
83.110.94.105:443
201.176.6.24:995
175.145.235.37:443
187.172.164.12:443
41.84.249.56:995
191.34.121.84:443
113.53.152.11:443
86.195.158.178:2222
109.228.220.196:443
82.41.63.217:443
82.152.39.39:443
106.51.48.188:50001
103.246.242.202:443
41.38.167.179:995
98.50.191.202:443
185.56.243.146:443
47.157.227.70:443
187.251.132.144:22
31.35.28.29:443
148.252.133.168:443
113.5.8.153:2222
180.129.108.214:995
138.186.28.253:443
89.137.52.44:443
122.118.129.227:995
75.99.168.194:61201
103.91.182.114:2222
Attributes
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot family
Files
-
d04caa7719610bd0aa0dd1cda75fe73365479b059968b75cf3a9e3fd41ad5ef7.bin.dll regsvr32 windows x86
0ac722e57c2c4e9d17a175801fddbcc5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_snprintf
_errno
_strtoi64
_vsnprintf
memchr
memset
free
_vsnwprintf
qsort
malloc
_time64
strncpy
strchr
strtod
localeconv
_ftol2_sse
atol
memcpy
kernel32
GetTickCount
GetModuleHandleA
GetWindowsDirectoryW
GetCurrentDirectoryW
GetSystemInfo
GetVersionExA
GetCommandLineW
LoadLibraryW
FlushFileBuffers
LocalAlloc
CreateMutexW
DuplicateHandle
GetCurrentThread
lstrcmpA
GetLastError
lstrcatA
CreateDirectoryW
DisconnectNamedPipe
lstrcpynW
GetProcessId
lstrlenW
lstrcatW
lstrcpyW
GetOEMCP
GetFileAttributesW
lstrcmpiW
GetDriveTypeW
K32GetModuleFileNameExW
MoveFileW
lstrcpynA
GetCurrentProcessId
SwitchToThread
GetModuleHandleW
GetProcAddress
HeapCreate
HeapFree
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
FreeLibrary
lstrcmpiA
GetSystemTimeAsFileTime
SetThreadPriority
SetFileAttributesW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
user32
DefWindowProcW
UnregisterClassA
RegisterClassExA
CharUpperBuffW
CharUpperBuffA
CreateWindowExA
DestroyWindow
shell32
CommandLineToArgvW
ole32
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
oleaut32
SafeArrayGetElement
SafeArrayGetLBound
SysFreeString
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayGetUBound
Exports
Exports
Sections
.text Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ