Overview

overview

10

Static

static

10

7ee6095ba8...71.dll

windows7-x64

1

7ee6095ba8...71.dll

windows10-2004-x64

3

Resubmissions

30-11-2023 22:19

231130-18nhnscb68 10

19-11-2023 21:30

231119-1cewnabg93 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ee6095ba8c4ed9fe11fbf5e703823e1aeae7f5443027738f55979b27ca57171.zip

  • Size

    78KB

  • MD5

    414689adb009ad7e9c6840d2bfdbe7d1

  • SHA1

    dd82ac9ff0ff3511315f920a6df0338601ef594d

  • SHA256

    b1d83b1843006e6066c8049c227d0184ca8dd300cde6e10b74e9fad49caab89b

  • SHA512

    152a6575dd56d1bc4ad433d3b6429dfdf90dfcdf220367fd2d6166c7ec895c11ea0cd6a0b1b25fb1984e88219d4d515e3b5eae80ba0cc9656bf42c01bffe79e5

  • SSDEEP

    1536:w8U+q7iXWFIpu7DzEIGpXYpDJBP9JdP4oJlahApDQzphuETpWrSwYHwnfls/VlYG:7DXVpu7HEIagR9JdPZahYDQzphuE5XHP

Score
10/10
obama1501640256791qakbot

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443

Signatures

  • Qakbot family
    qakbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 7ee6095ba8c4ed9fe11fbf5e703823e1aeae7f5443027738f55979b27ca57171.zip
    .zip

    Password: infected

  • 7ee6095ba8c4ed9fe11fbf5e703823e1aeae7f5443027738f55979b27ca57171.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    Password: infected

    3c4a379270b250744490829165226c41


    Headers

    Imports

    Exports

    Sections