Overview

overview

10

Static

static

10

4924-147-0...ry.dll

windows7-x64

1

4924-147-0...ry.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    4924-147-0x0000000010000000-0x0000000010024000-memory.dmp

  • Size

    144KB

  • MD5

    1b9aab54c8f0222684c473140c34ea67

  • SHA1

    294263e96eecd5e719e02d7d587311219dede699

  • SHA256

    5ac81aed3810cef16d627be303620a072fed5e8f51d3cdd549b3286b6e4cf820

  • SHA512

    fc1d0c6cd8975e709139bb336e5034bace5b50a85291b3a07189d246802ec701a903188e26df85c6c50db1b40471c28273433500421d940e9077e9091c5b82cb

  • SSDEEP

    3072:hFQGpV0kS95ObbMv8mCOihAAfBqJZmtfwcTBfw8mEE:VS9kPyCVh1fBqJEtfwcTBI8lE

Score
10/10
obama2681686733312qakbot

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

obama268

Campaign

1686733312

C2

125.99.76.102:443

80.12.88.148:2222

109.149.147.195:2222

27.99.32.26:2222

70.28.50.223:3389

70.28.50.223:32100

86.97.96.62:2222

66.241.183.99:443

74.12.146.45:2222

190.199.147.209:2222

47.205.25.170:443

12.172.173.82:993

12.172.173.82:22

84.35.26.14:995

72.134.124.16:443

85.240.173.251:2078

50.68.186.195:443

65.190.242.244:443

45.62.75.217:443

203.109.44.236:995

Signatures

  • Qakbot family
    qakbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4924-147-0x0000000010000000-0x0000000010024000-memory.dmp
    .dll windows x86


    Headers

    Sections