Overview

overview

10

Static

static

10

2044-57-0x...ry.dll

windows7-x64

1

2044-57-0x...ry.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2044-57-0x0000000004130000-0x0000000004153000-memory.dmp

  • Size

    140KB

  • Sample

    230314-vxp98saf9t

  • MD5

    971c0cc66f6fc343d3591b94ba5089ca

  • SHA1

    26b2ffeea143139520110274fde7b4754d9a5a6e

  • SHA256

    60b8d9b4c87ab32ada3da59608aa0ad722bae4d351acdbeaf90b61729863ee25

  • SHA512

    cc04e30b30c303daa2e1f5876d8a85b47b8cd63d4a5fa70c54523dd594db771ded6c4793a6afc59052369c78956f007ef398b76fd7cc194e9d1d82de7ba33c1d

  • SSDEEP

    3072:uVHCiSexeeIbkaitjnt/5CAEJ5UVHMTBffk1/BIMv+n:uJxAkaCjn/HEJqVHMTB3kFBRv

Score
10/10
qakbotobama2421678805546

Malware Config

Extracted

Family

qakbot

Version

404.266

Botnet

obama242

Campaign

1678805546

C2

92.239.81.124:443

176.202.46.81:443

2.49.58.47:2222

86.225.214.138:2222

74.66.134.24:443

213.31.90.183:2222

12.172.173.82:50001

202.187.87.178:995

70.53.96.223:995

92.154.45.81:2222

186.64.67.54:443

81.158.112.20:2222

190.191.35.122:443

68.173.170.110:8443

12.172.173.82:993

98.145.23.67:443

12.172.173.82:22

37.186.55.60:2222

84.216.198.124:6881

73.161.176.218:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      2044-57-0x0000000004130000-0x0000000004153000-memory.dmp

    • Size

      140KB

    • MD5

      971c0cc66f6fc343d3591b94ba5089ca

    • SHA1

      26b2ffeea143139520110274fde7b4754d9a5a6e

    • SHA256

      60b8d9b4c87ab32ada3da59608aa0ad722bae4d351acdbeaf90b61729863ee25

    • SHA512

      cc04e30b30c303daa2e1f5876d8a85b47b8cd63d4a5fa70c54523dd594db771ded6c4793a6afc59052369c78956f007ef398b76fd7cc194e9d1d82de7ba33c1d

    • SSDEEP

      3072:uVHCiSexeeIbkaitjnt/5CAEJ5UVHMTBffk1/BIMv+n:uJxAkaCjn/HEJqVHMTB3kFBRv

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks