qakbot | 116-165-0x0000000010000000-0x0000000010024000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
116-165-0x0000000010000000-0x0000000010024000-memory.dmp
Size 144KB
Sample230620-vv2v9aee3x
SHA256 2e1eaa1efd09e9ba5cdabeaee6ffb07b0f2d8f9895007d0a870862eb28a11769
MD5 531f1d9e5703d6e07b455efff87afa9f
SHA1 f279901e1668ae9ae753c14683e1f7536656c7c1
SHA512 7354d9f3a911596ad18575da5704de1c4c2353d55e87cbbb4419d4d4ca9931f1a705163b98e6e38efa585c4e09db97aab8c982ae01a6d082ca24fa22c232e805
SSDEEP 3072:5ajYySWFPnCBAvkcCgIgAhtJ9mRfB8TBfwInbEwqX:WCBAv7CbVhtJgRfB8TBIIb9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

obama269 1687245474 qakbot

Malware Config

Extracted

Family

qakbot

Version

404.1382

Botnet

obama269

Campaign

1687245474

91.160.70.68:32100
182.75.189.42:995
151.62.196.183:443
72.134.124.16:443
104.35.24.154:443
84.215.202.8:443
71.31.9.226:995
103.153.180.59:995
45.62.75.217:443
95.230.110.222:995
49.175.72.81:443
12.172.173.82:22
168.149.47.12:443
68.186.65.132:443
113.11.92.30:443
116.75.58.218:443
151.69.32.238:443
24.138.87.122:995
96.87.28.170:2222
147.147.30.126:2222
109.105.29.93:443
183.82.107.190:443
1.221.179.74:443
2.36.64.159:2078
12.172.173.82:995
201.171.159.196:443
192.252.166.24:80
176.44.123.169:995
2.82.8.80:443
81.150.169.174:2083
74.12.147.68:2222
86.248.228.57:2078
70.160.67.203:443
75.109.111.89:443
88.126.94.4:50000
70.28.50.223:3389
223.166.13.95:995
162.248.14.107:443
70.28.50.223:32100
84.35.26.14:995
183.87.163.165:443
92.186.69.229:2222
12.172.173.82:993
174.4.89.3:443
199.27.66.213:443
12.172.173.82:50001
81.229.117.95:2222
92.9.45.20:2222
12.172.173.82:20
91.169.12.198:32100
213.91.235.146:443
12.172.173.82:465
70.28.50.223:2078
75.98.154.19:443
136.232.179.26:443
67.87.119.216:2078
103.123.223.131:443
94.204.121.72:443
103.140.174.20:2222
95.45.50.93:2222
72.4.96.62:443
176.142.207.63:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
47.205.25.170:443
81.150.169.174:2078
81.150.169.174:2087
89.158.150.253:443
66.241.183.99:443
188.28.22.221:443
23.234.237.3:443
181.230.169.180:443
184.182.66.109:443
70.28.50.223:2083
175.156.65.126:2222
64.229.117.208:2222
77.126.99.230:443
87.252.106.235:995
12.172.173.82:32101
161.142.100.114:995
24.234.220.88:995
70.28.50.223:1194
24.234.80.122:995
81.150.169.174:2222
121.121.100.202:995
105.186.138.229:995
27.0.48.233:443
80.6.50.34:443
12.172.173.82:21
197.3.227.63:443
68.6.237.243:443
87.149.116.32:995
103.212.19.254:995
90.104.151.37:2222
178.175.187.254:443
86.170.169.53:443
119.82.71.94:2078
90.7.72.46:2222
217.165.255.105:443
116.88.76.28:443
125.99.69.177:443
73.155.10.79:443
103.141.50.46:995
142.181.206.222:2222
47.199.241.39:443
96.255.66.51:995
64.121.161.102:443
60.189.130.84:995
187.199.244.117:32103
110.159.115.244:443
72.205.104.134:443
12.172.173.82:2087
79.168.224.165:2222
81.157.120.247:443
124.122.47.219:443
201.227.113.134:2222
103.144.201.52:2078

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
116-165-0x0000000010000000-0x0000000010024000-memory.dmp

File Explorer

116-165-0x0000000010000000-0x0000000010024000-memory.dmp

.dll 144KB

116-165-0x0000000010000000-0x0000000010024000-memory.dmp

SHA256 2e1eaa1efd09e9ba5cdabeaee6ffb07b0f2d8f9895007d0a870862eb28a11769
MD5 531f1d9e5703d6e07b455efff87afa9f
SHA1 f279901e1668ae9ae753c14683e1f7536656c7c1
SHA512 7354d9f3a911596ad18575da5704de1c4c2353d55e87cbbb4419d4d4ca9931f1a705163b98e6e38efa585c4e09db97aab8c982ae01a6d082ca24fa22c232e805
SSDEEP 3072:5ajYySWFPnCBAvkcCgIgAhtJ9mRfB8TBfwInbEwqX:WCBAv7CbVhtJgRfB8TBIIb9
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4117

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths