qakbot | 3752-145-0x0000000010000000-0x0000000010024000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
3752-145-0x0000000010000000-0x0000000010024000-memory.dmp
Size 144KB
Sample230614-3psz6aea97
SHA256 836236bd04d33749e1359f96855e45f7d2396b49ca0d4f34de400fd2226d8f84
MD5 37ef8ce4f29e51676e1537ec34243f5e
SHA1 07d045a22e6a094917cc2ced353762fc47ba0fae
SHA512 7da11ad2b86b212758958a8721d2d81bf86a890bebb696232f26efe4c67cd99c1a64cd389db1e82f558ca268bea864d7482cefec13d8d30318009f82f0fcf50a
SSDEEP 3072:hFQGpV0kS95ObbMv8mCOihAAfBqJZmtfvucTBfw8mEE:VS9kPyCVh1fBqJEtfGcTBI8lE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

obama268 1686733312 qakbot

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

obama268

Campaign

1686733312

125.99.76.102:443
80.12.88.148:2222
109.149.147.195:2222
27.99.32.26:2222
70.28.50.223:3389
70.28.50.223:32100
86.97.96.62:2222
66.241.183.99:443
74.12.146.45:2222
190.199.147.209:2222
47.205.25.170:443
12.172.173.82:993
12.172.173.82:22
84.35.26.14:995
72.134.124.16:443
85.240.173.251:2078
50.68.186.195:443
65.190.242.244:443
45.62.75.217:443
203.109.44.236:995
174.58.146.57:443
105.184.159.9:995
94.207.115.105:443
197.0.146.211:443
197.204.11.218:443
92.9.45.20:2222
91.169.12.198:32100
12.172.173.82:20
70.64.77.115:443
71.31.9.49:995
24.234.220.88:990
95.45.50.93:2222
213.91.235.146:443
189.223.184.79:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
12.172.173.82:465
67.219.197.94:443
103.140.174.20:2222
12.172.173.82:995
90.29.86.138:2222
37.14.229.220:2222
89.181.227.42:2222
62.35.230.21:995
70.160.67.203:443
88.126.94.4:50000
203.219.204.180:443
147.219.4.194:443
92.20.204.198:2222
24.234.220.88:993
188.28.19.84:443
89.115.200.234:443
67.87.119.216:2083
86.98.222.20:443
161.142.100.114:995
103.139.242.6:443
103.123.223.153:443
24.234.220.88:995
102.158.231.164:443
175.156.65.126:2222
41.227.190.59:443
178.175.187.254:443
180.151.13.23:2078
12.172.173.82:50001
116.75.63.143:443
74.12.146.45:2083
78.192.109.105:2222
37.186.55.8:2222
121.121.100.202:995
104.35.24.154:443
199.27.66.213:443
181.165.19.254:443
81.229.117.95:2222
12.172.173.82:21
45.2.61.134:3389
162.248.14.107:443
103.212.19.254:995
2.82.8.80:443
103.144.201.63:2078
114.143.176.237:443
103.113.68.33:443
77.126.99.230:443
47.21.51.138:443
197.86.195.10:443
36.152.128.2:2222
12.172.173.82:32101
86.248.228.57:2078
92.149.250.113:2222
70.28.50.223:1194
82.127.153.75:2222
78.159.145.7:995
82.125.44.236:2222
24.234.220.88:465
64.121.161.102:443
187.199.244.117:32103
122.184.143.86:443
79.168.224.165:2222
65.30.139.145:995
151.62.174.154:443
124.122.47.148:443
31.190.240.11:443
92.239.81.124:443
31.53.29.210:2222
172.115.17.50:443
70.28.50.223:2083
124.149.143.189:2222
176.142.207.63:443
201.244.108.183:995
47.199.241.39:443
98.4.43.111:443
91.68.227.219:443
89.129.109.27:2222
67.87.119.216:2078
86.195.14.72:2222
72.205.104.134:443
1.221.179.74:443
58.162.223.233:443
49.175.72.81:443

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3752-145-0x0000000010000000-0x0000000010024000-memory.dmp

File Explorer

3752-145-0x0000000010000000-0x0000000010024000-memory.dmp

.dll 144KB

3752-145-0x0000000010000000-0x0000000010024000-memory.dmp

SHA256 836236bd04d33749e1359f96855e45f7d2396b49ca0d4f34de400fd2226d8f84
MD5 37ef8ce4f29e51676e1537ec34243f5e
SHA1 07d045a22e6a094917cc2ced353762fc47ba0fae
SHA512 7da11ad2b86b212758958a8721d2d81bf86a890bebb696232f26efe4c67cd99c1a64cd389db1e82f558ca268bea864d7482cefec13d8d30318009f82f0fcf50a
SSDEEP 3072:hFQGpV0kS95ObbMv8mCOihAAfBqJZmtfvucTBfw8mEE:VS9kPyCVh1fBqJEtfGcTBI8lE
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4117

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths