DllRegisterServer
Behavioral task
behavioral1
Sample
Qak_02CF0000.dll
Resource
win7-20231025-en
General
-
Target
3f004293165057ac40d7d2dc663cc62c877ebe29601251dcca24b6aa1062b7af.zip
-
Size
71KB
-
MD5
46718d3207c68011126d6df82f6592d2
-
SHA1
aed53cb1d4e3aabfc79b5519cd6599c1b6820259
-
SHA256
bee81307085f6a57816f92952e9081b791596b6f63fb061f69f80b4215abfb71
-
SHA512
1c4e6dd298f5bfea2596fb0da51d6e1b75341a781c46ba309c0f23e07de09d692b511a7adc612af7b8620ec9a07196b16ccdb331c22198cdd063679d7f45d2a3
-
SSDEEP
1536:GLbm5DJ0C7UaVHHJbOv2LCSv5FILzqQ4y4dkcxD0x5X7e:cbCDP7UoJbOolgLzqQ4pkXx5XC
Malware Config
Extracted
qakbot
403.10
obama150
1640256791
96.21.251.127:2222
70.51.134.181:2222
69.14.172.24:443
186.64.87.213:443
94.62.161.77:995
103.139.242.30:990
114.79.148.170:443
217.164.247.241:2222
178.153.86.181:443
136.232.34.70:443
37.210.226.125:61202
173.21.10.71:2222
31.219.154.176:32101
140.82.49.12:443
32.221.229.7:443
24.152.219.253:995
106.51.48.170:50001
114.38.161.124:995
96.37.113.36:993
190.39.205.165:443
45.9.20.200:2211
105.198.236.99:995
70.163.1.219:443
103.139.242.30:995
24.95.61.62:443
136.143.11.232:443
31.215.215.152:1194
103.143.8.71:6881
102.65.38.67:443
31.215.70.105:443
86.97.9.221:443
83.110.91.18:2222
63.153.187.104:443
74.15.2.252:2222
217.165.123.47:61200
41.228.22.180:443
24.53.49.240:443
149.135.101.20:443
94.200.181.154:995
67.209.195.198:443
209.210.95.228:32100
96.80.109.57:995
80.14.196.176:2222
38.70.253.226:2222
24.222.20.254:443
103.142.10.177:443
217.128.93.27:2222
103.157.122.130:21
24.178.196.158:2222
182.191.92.203:995
76.169.147.192:32103
78.180.66.163:995
89.41.8.168:443
190.73.3.148:2222
79.173.195.234:443
120.150.218.241:995
182.56.56.249:443
121.175.104.13:32100
76.25.142.196:443
79.167.192.206:995
59.6.7.83:61200
71.74.12.34:443
83.110.98.231:995
89.137.52.44:443
114.143.92.41:61202
67.165.206.193:993
94.60.254.81:443
23.233.146.92:443
73.151.236.31:443
187.162.59.232:995
72.252.201.34:995
50.237.134.22:995
201.172.31.95:80
100.1.119.41:443
40.134.247.125:995
109.12.111.14:443
89.101.97.139:443
24.55.112.61:443
93.48.80.198:995
75.188.35.168:443
83.199.144.45:2222
92.154.9.41:50002
111.125.245.116:995
39.49.105.128:995
82.152.39.39:443
105.106.30.144:443
31.35.28.29:443
103.139.242.30:22
218.101.110.3:995
182.176.180.73:443
121.175.104.13:443
65.100.174.110:8443
79.160.207.214:443
70.224.68.92:443
173.25.166.81:443
176.205.152.44:443
108.4.67.252:443
189.174.46.65:995
187.189.86.168:443
176.24.150.197:443
86.98.52.117:443
200.54.14.34:80
103.139.242.30:443
103.139.242.30:465
103.139.242.30:993
78.101.89.174:2222
78.101.89.174:443
73.5.119.219:443
74.5.148.57:443
68.186.192.69:443
50.33.112.74:995
70.93.80.154:995
75.169.58.229:32100
63.143.92.99:995
217.39.100.89:443
46.9.77.245:995
173.71.147.134:995
75.110.250.187:443
194.36.28.238:443
65.100.174.110:443
82.78.212.133:443
83.110.107.123:443
59.88.168.108:443
65.128.74.102:443
68.204.7.158:443
78.101.82.198:995
80.6.192.58:443
41.97.234.150:995
114.79.145.28:443
188.54.96.91:443
50.238.6.36:443
217.165.11.65:61200
103.143.8.71:995
2.178.67.97:61202
86.198.237.51:2222
88.253.171.236:995
187.172.146.123:443
92.167.4.71:2222
189.30.244.252:995
194.36.28.26:443
84.199.230.66:443
14.96.67.177:443
182.56.57.23:995
87.70.118.51:443
93.48.58.123:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack002/Qak_02CF0000.bin
Files
-
3f004293165057ac40d7d2dc663cc62c877ebe29601251dcca24b6aa1062b7af.zip.zip
Password: infected
-
3f004293165057ac40d7d2dc663cc62c877ebe29601251dcca24b6aa1062b7af.7z.7z
Password: infected
-
Qak_02CF0000.bin.dll regsvr32 windows:6 windows x86 arch:x86
Password: infected
3c4a379270b250744490829165226c41
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
inet_ntoa
msvcrt
localeconv
strtod
strchr
strncpy
_time64
malloc
free
memset
memchr
_strtoi64
_ftol2_sse
_vsnwprintf
memcpy
atol
_errno
qsort
_snprintf
_vsnprintf
kernel32
GetWindowsDirectoryW
GetSystemInfo
GetTickCount
LoadLibraryW
FlushFileBuffers
GetVersionExA
lstrcmpiA
LocalAlloc
SetFileAttributesW
FindNextFileW
FindFirstFileW
GetExitCodeProcess
GetCurrentProcess
CreateMutexA
lstrcmpA
DuplicateHandle
GetCurrentThread
lstrcpynA
GetLastError
lstrcatA
CreateDirectoryW
DisconnectNamedPipe
lstrcpynW
GetProcessId
lstrcatW
lstrcpyW
GetCurrentProcessId
lstrcmpiW
SetLastError
GetModuleFileNameW
GetFileAttributesW
GetModuleHandleA
MultiByteToWideChar
GetDriveTypeW
K32GetModuleFileNameExW
MoveFileW
SwitchToThread
GetProcAddress
HeapCreate
HeapFree
HeapAlloc
WideCharToMultiByte
LoadLibraryA
FreeLibrary
GetSystemTimeAsFileTime
SetThreadPriority
CreatePipe
user32
DestroyWindow
CreateWindowExA
UnregisterClassA
RegisterClassExA
CharUpperBuffA
DefWindowProcA
CharUpperBuffW
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
oleaut32
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayGetLBound
SysFreeString
VariantClear
SysAllocString
Exports
Exports
Sections
.text Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ