Overview

overview

10

Static

static

10

Qak_02CF0000.dll

windows7-x64

10

Qak_02CF0000.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3f004293165057ac40d7d2dc663cc62c877ebe29601251dcca24b6aa1062b7af.zip

  • Size

    71KB

  • MD5

    07e44cf2765bca5766a7d6248eba4ffd

  • SHA1

    80c4e067e249a4cd1ea6928a206867620109b0ff

  • SHA256

    40bec66001483976d09a8206fb32800a6ea14699eff6e1da0986eb3102d53f02

  • SHA512

    d937cae91583f732969d2c54e3c8619b3f2c5b53e05726a8989d28bce28ac21b64500ced4f6d4609cc805fb9e5d8884ba3fc5931b815c883cbbd3fa36573477e

  • SSDEEP

    1536:fSxYUMqoLY5DYWXAK7TYdjxgx17RrO7kpuzkSR31CToqlijQabK:KEqoLyYWwR1xgx17AgRSR3RfQ5

Score
10/10
obama1501640256791qakbot

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot family
    qakbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3f004293165057ac40d7d2dc663cc62c877ebe29601251dcca24b6aa1062b7af.zip
    .zip

    Password: infected

  • 3f004293165057ac40d7d2dc663cc62c877ebe29601251dcca24b6aa1062b7af.7z
    .7z

    Password: infected

  • Qak_02CF0000.bin
    .dll regsvr32 windows:6 windows x86

    Password: infected

    3c4a379270b250744490829165226c41


    Headers

    Imports

    Exports

    Sections