SecuriteInfo[.]com[.]Trojan[.]Win32[.]QakBot[.]RDB[.]MTB[.]12357[.]23983

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.12357.23983
Size

246KB
MD5

085802ad3c1f14c96e369f874faf858c
SHA1

da0226f8e4330e2606b95d8e5b7ff9b03abe94ac
SHA256

e4062a7a6372ff2dd5ebbf5561504f975d5fd31cf14c257ef2cce2a37d981b07
SHA512

c4316f5f93de13145ef7fc41ba5e93d5ec739f3ef150796695c8617b3f398f48257356ee990a71ba1c3ca410b80b0d1b818d50b93c213abfd58dde46d73a5fd9
SSDEEP

6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1Tz+:cRwBEZp11EFcUTz+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.12357.23983

Files

SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.12357.23983
.dll windows x86

b82f222a9ed7cfb1419f0e64bdeaac8b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateEventA
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
FileTimeToSystemTime
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
ReleaseMutex
SetEvent
SetUnhandledExceptionFilter
Sleep
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

user32

MessageBoxW

Exports

Exports

kkcs11h_addProvider
kkcs11h_certificate_create
kkcs11h_certificate_decrypt
kkcs11h_certificate_decryptAny
kkcs11h_certificate_deserializeCertificateId
kkcs11h_certificate_duplicateCertificateId
kkcs11h_certificate_ensureCertificateAccess
kkcs11h_certificate_ensureKeyAccess
kkcs11h_certificate_enumCertificateIds
kkcs11h_certificate_enumTokenCertificateIds
kkcs11h_certificate_freeCertificate
kkcs11h_certificate_freeCertificateId
kkcs11h_certificate_freeCertificateIdList
kkcs11h_certificate_getCertificateBlob
kkcs11h_certificate_getCertificateId
kkcs11h_certificate_getPromptMask
kkcs11h_certificate_getUserData
kkcs11h_certificate_lockSession
kkcs11h_certificate_releaseSession
kkcs11h_certificate_serializeCertificateId
kkcs11h_certificate_setCertificateIdCertificateBlob
kkcs11h_certificate_setPromptMask
kkcs11h_certificate_setUserData
kkcs11h_certificate_sign
kkcs11h_certificate_signAny
kkcs11h_certificate_signRecover
kkcs11h_certificate_unwrap
kkcs11h_data_del
kkcs11h_data_enumDataObjects
kkcs11h_data_freeDataIdList
kkcs11h_data_get
kkcs11h_data_put
kkcs11h_engine_setCrypto
kkcs11h_engine_setSystem
kkcs11h_forkFixup
kkcs11h_getFeatures
kkcs11h_getLogLevel
kkcs11h_getMessage
kkcs11h_getVersion
kkcs11h_initialize
kkcs11h_logout
kkcs11h_openssl_createSession
kkcs11h_openssl_freeSession
kkcs11h_openssl_getCleanupHook
kkcs11h_openssl_getX509
kkcs11h_openssl_session_getEVP
kkcs11h_openssl_session_getRSA
kkcs11h_openssl_session_getX509
kkcs11h_openssl_setCleanupHook
kkcs11h_plugAndPlay
kkcs11h_removeProvider
kkcs11h_setForkMode
kkcs11h_setLogHook
kkcs11h_setLogLevel
kkcs11h_setMaxLoginRetries
kkcs11h_setPINCachePeriod
kkcs11h_setPINPromptHook
kkcs11h_setProtectedAuthentication
kkcs11h_setSlotEventHook
kkcs11h_setTokenPromptHook
kkcs11h_terminate
kkcs11h_token_deserializeTokenId
kkcs11h_token_duplicateTokenId
kkcs11h_token_ensureAccess
kkcs11h_token_enumTokenIds
kkcs11h_token_freeTokenId
kkcs11h_token_freeTokenIdList
kkcs11h_token_login
kkcs11h_token_logout
kkcs11h_token_sameTokenId
must

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1012B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b82f222a9ed7cfb1419f0e64bdeaac8b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 62KB - Virtual size: 62KB

.data Size: 512B - Virtual size: 184B

.rdata Size: 22KB - Virtual size: 21KB

.bss Size: - Virtual size: 1012B

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 144KB - Virtual size: 141KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 62KB - Virtual size: 62KB

.data
Size: 512B - Virtual size: 184B

.rdata
Size: 22KB - Virtual size: 21KB

.bss
Size: - Virtual size: 1012B

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 144KB - Virtual size: 141KB

.reloc
Size: 4KB - Virtual size: 3KB