General

  • Target
    3980-145-0x0000000010000000-0x0000000010024000-memory.dmp
  • Size 144KB
  • Sample230623-vza84aga77
  • SHA256 7fa70f8bb05e9aa0b65f8842bc1edbc053eaa37c1866799fb1710f0608e56ecd
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • qakbot

Version
  • 404.1405

Botnet
  • obama271

Campaign
  • 1687438904

C2
  • 70.28.50.223:2083

  • 103.141.50.79:995

  • 184.182.66.109:443

  • 122.184.143.82:443

  • 91.254.145.252:443

  • 37.14.229.220:2222

  • 64.229.117.208:2222

  • 77.126.99.230:443

  • 87.252.106.235:995

  • 12.172.173.82:32101

  • 95.230.110.222:995

  • 88.169.33.180:2222

  • 70.28.50.223:1194

  • 72.80.94.230:443

  • 191.191.1.254:995

  • 209.171.160.69:995

  • 45.62.67.129:443

  • 24.234.80.122:995

  • 81.150.169.174:2222

  • 121.121.100.202:995

Signatures

  • Qakbot family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 3980-145-0x0000000010000000-0x0000000010024000-memory.dmp
    .dll 144KB

3980-145-0x0000000010000000-0x0000000010024000-memory.dmp

  • SHA256 7fa70f8bb05e9aa0b65f8842bc1edbc053eaa37c1866799fb1710f0608e56ecd
  • MD5 SHA1 SHA512 SSDEEP
  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
Major OS version
Entry point
4117
Magic Number
267
Subsystem
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths