Overview

overview

10

Static

static

10

old_unpacked_qbot.dll

windows7-x64

10

old_unpacked_qbot.dll

windows10-2004-x64

10

Resubmissions

31-10-2023 16:23

231031-tvvw9sba41 10

25-10-2023 22:14

231025-15mf7sha9z 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    old_unpacked_qbot.bin

  • Size

    120KB

  • MD5

    35927b301d9cd6c33a927b97dccf6266

  • SHA1

    1ccb9ec68f0fd685a58b1b6d2e78ba3b878783da

  • SHA256

    18df034ee69d675ce1b04b95569154f0e3fe41c8bd6a00e59e8dae24b41ed7f7

  • SHA512

    0cbbe3dbc6fea05760801bb812a8eac2b981f55a45aa994112e822e9f8f6741ae5052bab25dd1ab29d65e4b05fe353a0c796b9f8c0ddc4d89a03c13da69e081b

  • SSDEEP

    1536:DCEh82pWrjickOZol59ZJkCZuH6cYTUk8JrNZmwmIOvnToIfwsbuYkR:WH5r+ckl57J4HpYTaJBZfE/TBfwkuYk

Score
10/10
obama1251636625439qakbot

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama125

Campaign

1636625439

C2

117.198.155.237:443

190.73.3.148:2222

63.143.92.99:995

216.238.71.31:443

216.238.72.121:995

216.238.71.31:995

216.238.72.121:443

105.198.236.99:995

136.232.34.70:443

41.37.243.129:443

140.82.49.12:443

71.13.93.154:2222

96.246.158.154:995

102.65.38.57:443

71.13.93.154:6881

123.252.190.14:443

45.9.20.200:2211

136.143.11.232:443

103.143.8.71:995

103.142.10.177:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot family
    qakbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • old_unpacked_qbot.bin
    .dll regsvr32 windows:6 windows x86

    7b3bf330d8b8bdc633b50cd4fbfebe95


    Headers

    Imports

    Exports

    Sections