qakbot | 1920-89-0x0000000000170000-0x0000000000194000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1920-89-0x0000000000170000-0x0000000000194000-memory.dmp
Size 144KB
Sample230526-2p86pshe29
SHA256 be3064ab045747a4ee1d42fb91f2295050e44e13deb8912f262ce74b1f521404
MD5 c472e51f1d948105efba2b77e1aec98b
SHA1 4b099da424b0f2436b6e8600e5eb77dcf917a867
SHA512 2bffea73b862ee5b0fdc3543ed28afe68750825c495f26852a69987052344dfd6c2de16b8c2f1ee1bfdd2d075a2476e9f7d0025c4daf98264e2058c7bf076945
SSDEEP 3072:rR8htqU4THlu3/jk3VADXJoce7pTBf2FjyJ:FvHluPjKmDXJbe7pTBuF+J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bb29 1685100431 qakbot

Malware Config

Extracted

Family

qakbot

Version

404.1249

Botnet

BB29

Campaign

1685100431

50.68.186.195:443
66.180.234.51:2222
103.141.50.43:995
69.242.31.249:443
173.88.135.179:443
12.172.173.82:465
86.130.9.242:2222
92.27.86.48:2222
88.126.94.4:50000
113.11.92.30:443
12.172.173.82:995
92.154.17.149:2222
92.135.0.154:2222
212.169.233.141:3389
103.123.223.133:443
12.172.173.82:32101
70.28.50.223:3389
47.21.51.138:443
75.98.154.19:443
47.205.25.170:443
12.172.173.82:993
176.142.207.63:443
12.172.173.82:22
12.172.173.82:50001
190.199.228.254:2222
75.143.236.149:443
70.50.83.139:2222
184.153.132.82:443
122.184.143.86:443
70.28.50.223:2087
12.172.173.82:21
103.87.128.228:443
50.68.204.71:993
190.75.158.216:2222
73.41.215.237:443
186.75.95.6:443
90.29.86.138:2222
151.62.238.176:443
85.104.105.67:443
125.99.69.178:443
92.186.69.229:2222
78.130.215.67:443
27.99.32.26:2222
12.172.173.82:2087
50.68.204.71:443
69.119.123.159:2222
184.181.75.148:443
86.97.52.82:2222
92.20.204.198:2222
91.2.143.185:995
65.30.139.145:995
82.125.44.236:2222
89.36.206.69:995
104.35.24.154:443
197.0.76.189:443
89.129.109.27:2222
83.114.60.6:2222
151.65.69.12:443
87.202.101.164:50000
2.36.64.159:2078
69.133.162.35:443
87.223.86.50:443
105.101.34.87:443
75.141.227.169:443
105.186.138.188:995
172.115.17.50:443
95.45.50.93:2222
183.87.163.165:443
86.248.228.57:2078
24.198.114.130:995
78.192.109.105:2222
71.38.155.217:443
188.83.251.100:443
102.159.19.118:443
103.140.174.20:2222
92.9.45.20:2222
100.6.31.96:443
80.12.88.148:2222
70.112.206.5:443
198.2.51.242:993
197.164.217.136:995
86.128.15.167:2222
223.166.13.95:995
213.64.33.61:2222
72.134.124.16:443
70.28.50.223:2078
47.34.30.133:443
79.77.142.22:2222
31.17.195.13:8443
147.219.4.194:443
92.1.170.110:995
70.160.67.203:443
84.215.202.8:443
94.207.104.225:443
174.4.89.3:443
76.185.109.16:443
125.99.76.102:443
84.35.26.14:995
12.172.173.82:20
124.149.143.189:2222
96.56.197.26:2222
188.28.19.84:443
27.109.19.90:2078
70.48.46.235:2222
161.142.103.187:995
116.75.63.253:443
77.86.98.236:443
123.3.240.16:6881
83.110.223.61:443
109.50.128.59:2222
171.96.192.178:443
205.237.67.69:995
65.95.141.84:2222
74.58.71.237:443
91.169.12.198:32100
37.14.229.220:2222
70.28.50.223:32100
76.170.252.153:995
184.182.66.109:443
96.87.28.170:2222

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1920-89-0x0000000000170000-0x0000000000194000-memory.dmp

File Explorer

1920-89-0x0000000000170000-0x0000000000194000-memory.dmp

.dll 144KB

1920-89-0x0000000000170000-0x0000000000194000-memory.dmp

SHA256 be3064ab045747a4ee1d42fb91f2295050e44e13deb8912f262ce74b1f521404
MD5 c472e51f1d948105efba2b77e1aec98b
SHA1 4b099da424b0f2436b6e8600e5eb77dcf917a867
SHA512 2bffea73b862ee5b0fdc3543ed28afe68750825c495f26852a69987052344dfd6c2de16b8c2f1ee1bfdd2d075a2476e9f7d0025c4daf98264e2058c7bf076945
SSDEEP 3072:rR8htqU4THlu3/jk3VADXJoce7pTBf2FjyJ:FvHluPjKmDXJbe7pTBuF+J
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4245

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths