General
-
Target
Malware.zip
-
Size
464KB
-
Sample
230505-vyl9zadf2x
-
MD5
c11a169b860bbf491e0e70de4789b8c3
-
SHA1
17638e9fd92ed3afe5fac62b0a2e7cf2b2298f98
-
SHA256
f4802cf836fb00e8a4ea6062b91760c52a61972e1536024bc8d87cc3808cc4c6
-
SHA512
11ba3bfc4a138d9119875f462725d5cfff682957229ea8d39b86be92c3d9c4a209ec01a6f242ba65a83946c04c8d8a5747e0082189aa6ea5d9a152251188e510
-
SSDEEP
12288:8aV8+hYJGklb69DDjkHcDmtBedaz5y4enE:8EhwGub6Z3kHcDmtBZz5FSE
Static task
static1
Behavioral task
behavioral1
Sample
RunDLL-1.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
RunDLL-1.bat
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
RunDLL-1.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
pentaphylax.dll
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
pentaphylax.dll
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
pentaphylax.dll
Resource
win10v2004-20230220-en
Malware Config
Extracted
qakbot
404.1035
BB26
1683279184
27.109.19.90:2078
109.56.235.133:443
92.20.204.198:2222
98.145.23.67:443
50.68.204.71:995
151.55.186.41:443
12.172.173.82:21
70.28.50.223:3389
94.59.122.53:2222
12.172.173.82:32101
24.206.27.39:443
91.169.12.198:32100
12.172.173.82:993
2.82.8.80:443
104.35.24.154:443
5.30.216.183:443
50.68.204.71:443
12.172.173.82:995
103.140.174.20:2222
173.88.135.179:443
71.38.155.217:443
71.34.185.40:443
37.14.229.220:2222
70.28.50.223:1194
161.142.98.36:995
85.53.128.200:3389
24.236.90.196:2078
91.82.3.239:443
45.243.237.211:995
50.68.204.71:993
186.64.67.41:443
172.115.17.50:443
62.35.230.21:995
70.28.50.223:32100
139.226.47.229:995
103.42.86.42:995
35.143.97.145:995
31.53.29.198:2222
211.248.50.162:443
89.114.140.100:443
58.186.75.42:443
82.127.153.75:2222
109.50.128.59:2222
162.248.14.107:443
103.111.70.66:443
100.6.31.96:443
103.141.50.79:995
178.175.187.254:443
125.99.69.178:443
105.184.115.147:995
217.165.234.249:443
12.172.173.82:2087
122.184.143.85:443
69.133.162.35:443
176.142.207.63:443
74.93.148.97:995
12.172.173.82:22
184.182.66.109:443
71.78.95.86:995
70.112.206.5:443
72.134.124.16:443
81.229.117.95:2222
12.172.173.82:20
103.111.70.66:995
201.208.46.165:2222
114.143.176.235:443
103.212.19.254:995
67.10.9.125:995
99.230.89.236:2083
43.243.215.210:443
157.119.85.203:443
12.172.173.82:50001
202.184.123.13:443
77.124.5.149:443
125.99.76.102:443
96.56.197.26:2078
87.243.146.59:443
197.14.179.187:443
197.1.253.66:443
83.92.85.93:443
213.91.235.146:443
90.104.151.37:2222
123.23.65.244:443
78.192.109.105:2222
92.9.45.20:2222
188.28.72.118:443
70.28.50.223:2083
71.104.102.13:2222
122.186.210.254:443
220.240.15.200:443
41.186.88.38:443
85.104.105.67:443
87.57.13.215:443
89.79.229.50:443
2.36.64.159:2078
88.168.199.84:50000
83.114.60.6:2222
92.27.86.48:2222
50.68.186.195:443
92.188.241.102:443
96.87.28.170:2222
92.1.170.110:995
174.4.89.3:443
23.30.173.133:443
70.51.136.238:2222
68.173.170.110:8443
47.21.51.138:443
70.64.77.115:443
76.16.49.134:443
64.121.161.102:443
108.190.115.159:443
98.19.224.125:995
12.172.173.82:465
147.219.4.194:443
86.250.12.86:2222
188.176.171.3:443
88.126.94.4:50000
87.202.101.164:50000
74.92.243.115:50000
98.176.5.56:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
RunDLL-1.bat
-
Size
37B
-
MD5
f2d66627c4d0151ec2faaad5d6a6192a
-
SHA1
275516472743639d71b09c7ca6f39f03aaebe317
-
SHA256
4a9aca6d85d853aaea471af748a67e56a187a2cdc31b80a95f222763833e97be
-
SHA512
aac3b89f1f1c2691ce032f8d5d22685f4d5090bbf684ad128a6c9d0018b793df63d04c6d5bb1b217bd542520b5cf2a0a2b33873e39f99943ad45767063fa297a
-
Blocklisted process makes network request
-
-
-
Target
pentaphylax.epopee
-
Size
904KB
-
MD5
f7347e5114666cf7da420417092b3987
-
SHA1
055d1c60dc2b12f0836b77957417e3466a030fa7
-
SHA256
00fe428195ff6b054f43358959a1dcd8198747ff310c59c40a37d264ebeddfa1
-
SHA512
84482d2a78a4cee6295f737951f3b9ad480e235b77e4f06332a8378530e84a47197f2b0ecc5c5bded7a268bd7d49c398f850b57c76e804e777ccebad734d9556
-
SSDEEP
24576:xHA2XMYABs772W/8vLj/9sgR+OVnh8gt42vCkzeztwPOfQWyBZPPdhbBF91Xe95:FMYABC8vLj/2jA8gxZPPdhbBP1O95
Score3/10 -