SecuriteInfo[.]com[.]Trojan[.]Win32[.]QakBot[.]RDB[.]MTB[.]4624[.]17445

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.4624.17445
Size

246KB
MD5

294ef2f13964e784cd42735e804f476c
SHA1

ea5b2f2c95792c132080c177f78c9e12e34cc7d8
SHA256

cc7bba12ac6431a6f376ba0e5c7a75e719fc3e180cc43e48acee406c0fe2759f
SHA512

e2c35c4e5368882854e97c9f021cc163b0e8fd4bd3adf7edf43bef1da892deb4eabc40cb818151eba095c5c68057efb2a71fa44aff68c0c2468308dd95fe5edd
SSDEEP

6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1TzM:cRwBEZp11EFcUTzM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.4624.17445

Files

SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.4624.17445
.dll windows x86

b82f222a9ed7cfb1419f0e64bdeaac8b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateEventA
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
FileTimeToSystemTime
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
ReleaseMutex
SetEvent
SetUnhandledExceptionFilter
Sleep
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

user32

MessageBoxW

Exports

Exports

kkcs11h_addProvider
kkcs11h_certificate_create
kkcs11h_certificate_decrypt
kkcs11h_certificate_decryptAny
kkcs11h_certificate_deserializeCertificateId
kkcs11h_certificate_duplicateCertificateId
kkcs11h_certificate_ensureCertificateAccess
kkcs11h_certificate_ensureKeyAccess
kkcs11h_certificate_enumCertificateIds
kkcs11h_certificate_enumTokenCertificateIds
kkcs11h_certificate_freeCertificate
kkcs11h_certificate_freeCertificateId
kkcs11h_certificate_freeCertificateIdList
kkcs11h_certificate_getCertificateBlob
kkcs11h_certificate_getCertificateId
kkcs11h_certificate_getPromptMask
kkcs11h_certificate_getUserData
kkcs11h_certificate_lockSession
kkcs11h_certificate_releaseSession
kkcs11h_certificate_serializeCertificateId
kkcs11h_certificate_setCertificateIdCertificateBlob
kkcs11h_certificate_setPromptMask
kkcs11h_certificate_setUserData
kkcs11h_certificate_sign
kkcs11h_certificate_signAny
kkcs11h_certificate_signRecover
kkcs11h_certificate_unwrap
kkcs11h_data_del
kkcs11h_data_enumDataObjects
kkcs11h_data_freeDataIdList
kkcs11h_data_get
kkcs11h_data_put
kkcs11h_engine_setCrypto
kkcs11h_engine_setSystem
kkcs11h_forkFixup
kkcs11h_getFeatures
kkcs11h_getLogLevel
kkcs11h_getMessage
kkcs11h_getVersion
kkcs11h_initialize
kkcs11h_logout
kkcs11h_openssl_createSession
kkcs11h_openssl_freeSession
kkcs11h_openssl_getCleanupHook
kkcs11h_openssl_getX509
kkcs11h_openssl_session_getEVP
kkcs11h_openssl_session_getRSA
kkcs11h_openssl_session_getX509
kkcs11h_openssl_setCleanupHook
kkcs11h_plugAndPlay
kkcs11h_removeProvider
kkcs11h_setForkMode
kkcs11h_setLogHook
kkcs11h_setLogLevel
kkcs11h_setMaxLoginRetries
kkcs11h_setPINCachePeriod
kkcs11h_setPINPromptHook
kkcs11h_setProtectedAuthentication
kkcs11h_setSlotEventHook
kkcs11h_setTokenPromptHook
kkcs11h_terminate
kkcs11h_token_deserializeTokenId
kkcs11h_token_duplicateTokenId
kkcs11h_token_ensureAccess
kkcs11h_token_enumTokenIds
kkcs11h_token_freeTokenId
kkcs11h_token_freeTokenIdList
kkcs11h_token_login
kkcs11h_token_logout
kkcs11h_token_sameTokenId
must

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1012B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b82f222a9ed7cfb1419f0e64bdeaac8b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 62KB - Virtual size: 62KB

.data Size: 512B - Virtual size: 184B

.rdata Size: 22KB - Virtual size: 21KB

.bss Size: - Virtual size: 1012B

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 144KB - Virtual size: 141KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 62KB - Virtual size: 62KB

.data
Size: 512B - Virtual size: 184B

.rdata
Size: 22KB - Virtual size: 21KB

.bss
Size: - Virtual size: 1012B

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 144KB - Virtual size: 141KB

.reloc
Size: 4KB - Virtual size: 3KB