qakbot | 740-86-0x0000000000400000-0x00000000006A6000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
740-86-0x0000000000400000-0x00000000006A6000-memory.dmp
Size 2.6MB
Sample230726-mla26sbd7t
SHA256 f1a9b678c4ac60d5da6af25b0a4a0eab3f04d482c776e8a173b782bb31e15450
MD5 e84cce54a6094ad469814612bf26b180
SHA1 38bb8d80051277dcace334a0ce266ad4fa6710c3
SHA512 1de77eedd00975e28774aac6f1a56d12ff3c2ed12b94b7a6129df37edacfdc4d38e90ed1932536dbc08e25f48267328e2ba9f85d3ee4329476d0e6b69b9c0ac6
SSDEEP 12288:G6KiviCyU2ZLHqpVxTp5WK1QAPPAV/Ykfgn6ggK:DKiviC1CT45xQwkfg93
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

spx143 1592482956 qakbot

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx143

Campaign

1592482956

39.36.254.179:995
24.139.132.70:443
24.202.42.48:2222
72.204.242.138:443
172.242.156.50:995
72.204.242.138:20
68.174.15.223:443
74.193.197.246:443
96.56.237.174:990
64.19.74.29:995
70.168.130.172:443
189.236.166.167:443
68.4.137.211:443
76.187.8.160:443
76.86.57.179:2222
73.226.220.56:443
67.250.184.157:443
75.183.171.155:3389
173.172.205.216:443
173.3.132.17:995
172.78.30.215:443
207.255.161.8:32103
75.137.239.211:443
68.49.120.179:443
206.51.202.106:50003
82.127.193.151:2222
207.255.161.8:2222
207.255.161.8:2087
24.152.219.253:995
187.19.151.218:995
197.37.48.37:993
188.241.243.175:443
72.88.119.131:443
89.137.211.239:443
108.30.125.94:443
187.163.101.137:995
100.19.7.242:443
45.77.164.175:443
80.240.26.178:443
66.208.105.6:443
207.246.75.201:443
199.247.22.145:443
199.247.16.80:443
95.77.223.148:443
68.60.221.169:465
5.107.220.84:2222
41.228.212.22:443
86.233.4.153:2222
68.200.23.189:443
201.146.127.158:443
79.114.199.39:443
87.65.204.240:995
71.74.12.34:443
217.162.149.212:443
195.162.106.93:2222
75.165.112.82:50002
201.248.102.4:2078
96.41.93.96:443
89.247.216.127:443
84.232.238.30:443
103.238.231.40:443
174.34.67.106:2222
98.115.138.61:443
91.125.21.16:2222
84.247.55.190:443
193.248.44.2:2222
74.135.37.79:443
78.96.190.54:443
86.126.97.183:2222
2.50.47.97:2222
68.39.160.40:443
96.232.203.15:443
86.144.150.29:2222
71.220.191.200:443
24.231.54.185:2222
80.14.209.42:2222
24.164.79.147:443
70.183.127.6:995
47.153.115.154:993
184.180.157.203:2222
50.104.68.223:443
67.165.206.193:995
200.113.201.83:993
47.153.115.154:465
24.42.14.241:995
189.160.203.110:443
188.27.76.139:443
207.255.161.8:32102
49.207.105.25:443
71.210.177.4:443
117.242.253.163:443
50.244.112.106:443
69.92.54.95:995
41.34.91.90:995
72.204.242.138:53
41.97.138.74:443
72.29.181.77:2078
71.88.168.176:443
2.50.171.142:443
67.83.54.76:2222
86.125.145.90:2222
47.153.115.154:995
24.122.157.93:443
47.146.169.85:443
72.181.9.163:443
187.155.74.5:443
71.209.187.4:443
74.75.216.202:443
24.44.180.236:2222
24.43.22.220:993
108.188.116.179:443
100.4.173.223:443
76.170.77.99:443
70.95.118.217:443
134.0.196.46:995
68.225.56.31:443
72.204.242.138:32102
72.204.242.138:50001
108.190.151.108:2222
72.204.242.138:465
50.244.112.10:443
173.22.120.11:2222
24.43.22.220:995
24.43.22.220:443
92.17.167.87:2222
72.209.191.27:443
72.204.242.138:80
71.187.170.235:443
96.56.237.174:32103
71.187.7.239:443
184.98.104.7:995
70.124.29.226:443
137.99.224.198:443
73.23.194.75:443
151.205.102.42:443
64.224.76.152:443
72.204.242.138:32100
173.187.101.221:443
72.179.13.59:443
208.93.202.49:443
70.174.3.241:443
96.37.137.42:443
76.111.128.194:443
67.209.195.198:3389
61.3.184.27:443
24.42.14.241:443
74.56.167.31:443
5.193.61.212:2222
117.216.177.171:443

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
740-86-0x0000000000400000-0x00000000006A6000-memory.dmp

File Explorer

740-86-0x0000000000400000-0x00000000006A6000-memory.dmp

.exe 2.6MB

740-86-0x0000000000400000-0x00000000006A6000-memory.dmp

SHA256 f1a9b678c4ac60d5da6af25b0a4a0eab3f04d482c776e8a173b782bb31e15450
MD5 e84cce54a6094ad469814612bf26b180
SHA1 38bb8d80051277dcace334a0ce266ad4fa6710c3
SHA512 1de77eedd00975e28774aac6f1a56d12ff3c2ed12b94b7a6129df37edacfdc4d38e90ed1932536dbc08e25f48267328e2ba9f85d3ee4329476d0e6b69b9c0ac6
SSDEEP 12288:G6KiviCyU2ZLHqpVxTp5WK1QAPPAV/Ykfgn6ggK:DKiviC1CT45xQwkfg93
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6696

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths