Overview

overview

10

Static

static

10

3752-145-0...ry.dll

windows7-x64

1

3752-145-0...ry.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    3752-145-0x0000000010000000-0x0000000010024000-memory.dmp

  • Size

    144KB

  • MD5

    37ef8ce4f29e51676e1537ec34243f5e

  • SHA1

    07d045a22e6a094917cc2ced353762fc47ba0fae

  • SHA256

    836236bd04d33749e1359f96855e45f7d2396b49ca0d4f34de400fd2226d8f84

  • SHA512

    7da11ad2b86b212758958a8721d2d81bf86a890bebb696232f26efe4c67cd99c1a64cd389db1e82f558ca268bea864d7482cefec13d8d30318009f82f0fcf50a

  • SSDEEP

    3072:hFQGpV0kS95ObbMv8mCOihAAfBqJZmtfvucTBfw8mEE:VS9kPyCVh1fBqJEtfGcTBI8lE

Score
10/10
obama2681686733312qakbot

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

obama268

Campaign

1686733312

C2

125.99.76.102:443

80.12.88.148:2222

109.149.147.195:2222

27.99.32.26:2222

70.28.50.223:3389

70.28.50.223:32100

86.97.96.62:2222

66.241.183.99:443

74.12.146.45:2222

190.199.147.209:2222

47.205.25.170:443

12.172.173.82:993

12.172.173.82:22

84.35.26.14:995

72.134.124.16:443

85.240.173.251:2078

50.68.186.195:443

65.190.242.244:443

45.62.75.217:443

203.109.44.236:995

Signatures

  • Qakbot family
    qakbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3752-145-0x0000000010000000-0x0000000010024000-memory.dmp
    .dll windows x86


    Headers

    Sections