Overview

overview

10

Static

static

10

c2ba065654...3a.dll

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    455253_c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.zip

  • Size

    237KB

  • MD5

    2739602af9de4e37007f49887c17dc8b

  • SHA1

    9c51c995d91ae838349a35746ed173e7fdfa4df8

  • SHA256

    5b1928e0f4afd659d9a1aa169ba9e794e57251725a8674af205392d3a2f255b5

  • SHA512

    62eff2f78c0e999b296c18f99977c9c6e7d68bb9ee7a92db9069a2bc6f4e76536711d68123db6676061a3b351e75f29c841c145b016b44ca56021ca1d51817a5

  • SSDEEP

    6144:fr/nfFCyA5pomBssfsvBERD4fe9iwVmtuVU0UJ7I4h7swR2:RDA0mBsgxtyyNmtuVU0Q7rh7swI

Score
10/10
aa1649660679qakbot

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1649660679

C2

41.228.22.180:443

47.23.89.62:995

176.67.56.94:443

103.107.113.120:443

148.64.96.100:443

47.180.172.159:443

181.118.183.98:443

140.82.49.12:443

103.87.95.133:2222

96.21.251.127:2222

197.167.62.14:993

46.107.48.202:443

24.43.99.75:443

172.115.177.204:2222

80.11.74.81:2222

66.98.42.102:443

75.99.168.194:61201

173.174.216.62:443

45.9.20.200:443

39.41.158.185:995
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot family
    qakbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 455253_c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.zip
    .zip

    Password: infected

  • c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a
    .dll regsvr32 windows:6 windows x86 arch:x86

    8e5fe034ddea581be35472bb9e09c763


    Headers

    Imports

    Exports

    Sections