Overview

overview

10

Static

static

10

1008-85-0x...ry.dll

windows7-x64

1

1008-85-0x...ry.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1008-85-0x0000000000130000-0x0000000000154000-memory.dmp

  • Size

    144KB

  • MD5

    802fa6498c4cc0cd4937929fd831145c

  • SHA1

    b25928ce3a03db5d24b7355353871d8330cba4b2

  • SHA256

    46672233fdbae0255e3d5fb53d4388a590acbb3c0a4a6dfa9aff3b93b9e3e31a

  • SHA512

    07dabf592804730a2f5e8a19dde0d3a0bfc5bfc2a25d6a94905e4ff290b7e58f8ab089dcba05e18a706c296a7b2ab1b24fa644cbe7ac640cdf37601521e4fc41

  • SSDEEP

    3072:3eb57Y1JZZnXTtXAbpJZJpl0TBfAR6LP:F1JznjtQbpJTpl0TB4Rm

Score
10/10
obama2651685436052qakbot

Malware Config

Extracted

Family

qakbot

Version

404.1320

Botnet

obama265

Campaign

1685436052

C2

103.42.86.42:995

174.4.89.3:443

161.142.103.187:995

78.160.146.127:443

84.35.26.14:995

12.172.173.82:20

70.28.50.223:2078

124.149.143.189:2222

70.160.67.203:443

186.64.67.30:443

103.123.223.133:443

94.207.104.225:443

89.114.140.100:443

213.64.33.61:2222

86.176.144.234:2222

72.134.124.16:443

47.34.30.133:443

109.50.149.241:2222

85.104.105.67:443

81.111.108.123:443

Signatures

  • Qakbot family
    qakbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1008-85-0x0000000000130000-0x0000000000154000-memory.dmp
    .dll windows x86


    Headers

    Sections