qakbot | 5048-165-0x0000000010000000-0x0000000010024000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
5048-165-0x0000000010000000-0x0000000010024000-memory.dmp
Size 144KB
Sample230620-vy9ehadc52
SHA256 1595fa4c6ff6cffb88b5109d8dbf9232e67f8860727f2718f2f48a36c0651568
MD5 69a5e55aff7998d8bf070750b1524b52
SHA1 31b584ce08a2110fd080c2f2a85470fec4048380
SHA512 57c36aa9e030315c6a6a470bf0902c925069466ba44572a0f71aa6fcc453884fa8eb0530a1ab3c911969f232b124beb1015ba219ff3a1ee3cc4b0d1f531aef13
SSDEEP 3072:5ajYySWFPnCBAvkcCgIgAhtJ9mRfU8TBfwInbEwqX:WCBAv7CbVhtJgRfU8TBIIb9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

obama269 1687245474 qakbot

Malware Config

Extracted

Family

qakbot

Version

404.1382

Botnet

obama269

Campaign

1687245474

91.160.70.68:32100
182.75.189.42:995
151.62.196.183:443
72.134.124.16:443
104.35.24.154:443
84.215.202.8:443
71.31.9.226:995
103.153.180.59:995
45.62.75.217:443
95.230.110.222:995
49.175.72.81:443
12.172.173.82:22
168.149.47.12:443
68.186.65.132:443
113.11.92.30:443
116.75.58.218:443
151.69.32.238:443
24.138.87.122:995
96.87.28.170:2222
147.147.30.126:2222
109.105.29.93:443
183.82.107.190:443
1.221.179.74:443
2.36.64.159:2078
12.172.173.82:995
201.171.159.196:443
192.252.166.24:80
176.44.123.169:995
2.82.8.80:443
81.150.169.174:2083
74.12.147.68:2222
86.248.228.57:2078
70.160.67.203:443
75.109.111.89:443
88.126.94.4:50000
70.28.50.223:3389
223.166.13.95:995
162.248.14.107:443
70.28.50.223:32100
84.35.26.14:995
183.87.163.165:443
92.186.69.229:2222
12.172.173.82:993
174.4.89.3:443
199.27.66.213:443
12.172.173.82:50001
81.229.117.95:2222
92.9.45.20:2222
12.172.173.82:20
91.169.12.198:32100
213.91.235.146:443
12.172.173.82:465
70.28.50.223:2078
75.98.154.19:443
136.232.179.26:443
67.87.119.216:2078
103.123.223.131:443
94.204.121.72:443
103.140.174.20:2222
95.45.50.93:2222
72.4.96.62:443
176.142.207.63:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
47.205.25.170:443
81.150.169.174:2078
81.150.169.174:2087
89.158.150.253:443
66.241.183.99:443
188.28.22.221:443
23.234.237.3:443
181.230.169.180:443
184.182.66.109:443
70.28.50.223:2083
175.156.65.126:2222
64.229.117.208:2222
77.126.99.230:443
87.252.106.235:995
12.172.173.82:32101
161.142.100.114:995
24.234.220.88:995
70.28.50.223:1194
24.234.80.122:995
81.150.169.174:2222
121.121.100.202:995
105.186.138.229:995
27.0.48.233:443
80.6.50.34:443
12.172.173.82:21
197.3.227.63:443
68.6.237.243:443
87.149.116.32:995
103.212.19.254:995
90.104.151.37:2222
178.175.187.254:443
86.170.169.53:443
119.82.71.94:2078
90.7.72.46:2222
217.165.255.105:443
116.88.76.28:443
125.99.69.177:443
73.155.10.79:443
103.141.50.46:995
142.181.206.222:2222
47.199.241.39:443
96.255.66.51:995
64.121.161.102:443
60.189.130.84:995
187.199.244.117:32103
110.159.115.244:443
72.205.104.134:443
12.172.173.82:2087
79.168.224.165:2222
81.157.120.247:443
124.122.47.219:443
201.227.113.134:2222
103.144.201.52:2078

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5048-165-0x0000000010000000-0x0000000010024000-memory.dmp

File Explorer

5048-165-0x0000000010000000-0x0000000010024000-memory.dmp

.dll 144KB

5048-165-0x0000000010000000-0x0000000010024000-memory.dmp

SHA256 1595fa4c6ff6cffb88b5109d8dbf9232e67f8860727f2718f2f48a36c0651568
MD5 69a5e55aff7998d8bf070750b1524b52
SHA1 31b584ce08a2110fd080c2f2a85470fec4048380
SHA512 57c36aa9e030315c6a6a470bf0902c925069466ba44572a0f71aa6fcc453884fa8eb0530a1ab3c911969f232b124beb1015ba219ff3a1ee3cc4b0d1f531aef13
SSDEEP 3072:5ajYySWFPnCBAvkcCgIgAhtJ9mRfU8TBfwInbEwqX:WCBAv7CbVhtJgRfU8TBIIb9
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4117

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths