qakbot | 1700-55-0x00000000001E0000-0x0000000000204000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1700-55-0x00000000001E0000-0x0000000000204000-memory.dmp
Size 144KB
Sample230602-1xe26aee98
SHA256 4f48dd64fbb28eb1b01daeee1b339386181cb3a0566e24da954d410bd469f7a0
MD5 eddaf5785d4ae321f5a73f967d7896c7
SHA1 9f1adf455310912f0a187e5082f38e31182baa96
SHA512 2ca85c1f94f59720c0e3ca8303ae8041bcc8baae2ab27c83235b0221219741390b12f6bcace0301fb86598399c1b66242874a4cfe1d93b9cb4a5dab6d4baaf77
SSDEEP 3072:aB6GqSbBtB1aC+0Qd66CAO/Jor7NcTBfwcsLu:gVtBo0a66HO/Jc7NcTBocU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bb30 1685604052 qakbot

Malware Config

Extracted

Family

qakbot

Version

404.1346

Botnet

BB30

Campaign

1685604052

47.199.241.39:443
93.147.235.8:443
75.141.227.169:443
45.243.142.31:995
79.92.15.6:443
85.104.105.67:443
89.129.109.27:2222
86.176.83.44:2222
24.234.220.88:993
89.32.156.5:995
12.172.173.82:22
103.101.203.177:443
70.28.50.223:2083
98.187.21.2:443
70.49.205.198:2222
96.56.197.26:2222
92.9.45.20:2222
86.195.14.72:2222
172.115.17.50:443
100.4.163.158:2222
80.12.88.148:2222
213.64.33.92:2222
113.11.92.30:443
78.192.109.105:2222
47.34.30.133:443
122.184.143.86:443
198.2.51.242:993
165.120.169.171:2222
88.126.94.4:50000
82.125.44.236:2222
117.195.16.105:993
147.219.4.194:443
80.167.196.79:443
92.154.17.149:2222
184.181.75.148:443
95.45.50.93:2222
84.35.26.14:995
201.143.215.69:443
12.172.173.82:2087
50.68.204.71:443
64.121.161.102:443
2.82.8.80:443
79.77.142.22:2222
12.172.173.82:995
223.166.13.95:995
72.134.124.16:443
213.55.33.103:443
183.87.163.165:443
174.4.89.3:443
27.253.11.10:2222
2.49.63.160:2222
92.186.69.229:2222
69.133.162.35:443
81.111.108.123:443
12.172.173.82:20
188.28.19.84:443
90.29.86.138:2222
70.160.67.203:443
186.64.67.30:443
5.107.153.132:2222
125.63.125.205:2078
2.36.64.159:2078
71.38.155.217:443
205.237.67.69:995
70.64.77.115:443
24.234.220.88:990
96.56.197.26:2083
70.28.50.223:2078
103.123.223.133:443
199.27.66.213:443
83.249.198.100:2222
94.204.202.106:443
77.126.99.230:443
72.205.104.134:443
65.95.141.84:2222
173.88.135.179:443
220.240.164.182:443
96.87.28.170:2222
176.142.207.63:443
12.172.173.82:32101
70.50.83.216:2222
161.142.103.187:995
45.62.70.33:443
24.234.220.88:465
103.141.50.43:995
90.7.72.46:2222
76.178.148.107:2222
116.74.163.130:443
46.246.254.242:995
70.28.50.223:2087
12.172.173.82:465
178.175.187.254:443
27.0.48.233:443
83.110.223.61:443
184.182.66.109:443
70.28.50.223:32100
50.68.204.71:993
70.28.50.223:3389
50.68.186.195:443
47.205.25.170:443
12.172.173.82:993
76.170.252.153:995
69.242.31.249:443
79.168.224.165:2222
75.143.236.149:443
14.192.241.76:995
81.229.117.95:2222
98.145.23.67:443
98.37.25.99:443
69.160.121.6:61201
12.172.173.82:21
75.109.111.89:443
76.86.31.59:443
80.6.50.34:443
116.120.145.170:995
201.244.108.183:995
58.186.75.42:443
68.203.69.96:443
47.149.134.231:443

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1700-55-0x00000000001E0000-0x0000000000204000-memory.dmp

File Explorer

1700-55-0x00000000001E0000-0x0000000000204000-memory.dmp

.dll 144KB

1700-55-0x00000000001E0000-0x0000000000204000-memory.dmp

SHA256 4f48dd64fbb28eb1b01daeee1b339386181cb3a0566e24da954d410bd469f7a0
MD5 eddaf5785d4ae321f5a73f967d7896c7
SHA1 9f1adf455310912f0a187e5082f38e31182baa96
SHA512 2ca85c1f94f59720c0e3ca8303ae8041bcc8baae2ab27c83235b0221219741390b12f6bcace0301fb86598399c1b66242874a4cfe1d93b9cb4a5dab6d4baaf77
SSDEEP 3072:aB6GqSbBtB1aC+0Qd66CAO/Jor7NcTBfwcsLu:gVtBo0a66HO/Jc7NcTBocU
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4117

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths