hvsi
Resubmissions
08-01-2024 17:44
240108-wa899seegn 308-01-2024 17:43
240108-waxapseefp 308-01-2024 17:42
240108-wagv1sfda8 308-01-2024 17:41
240108-v9veqafch9 324-12-2023 19:30
231224-x73dnabgaj 324-12-2023 19:29
231224-x7g3qabfan 324-12-2023 19:28
231224-x6zalsdcg6 324-12-2023 19:27
231224-x6k3zsdca3 324-12-2023 19:27
231224-x545gadbb8 324-12-2023 19:21
231224-x2x7racdh3 3Static task
static1
Behavioral task
behavioral1
Sample
qbot_v5.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
qbot_v5.dll
Resource
win10v2004-20231215-en
General
-
Target
qbot_v5.dll
-
Size
184KB
-
MD5
ad21bf01af70637e231a2882c03e7069
-
SHA1
5ed92e7e80dcac57771ec421692b5e82f65ca65d
-
SHA256
c373639f248a4ab9e180efba40efd66249785657542cef5f7755c2432e98fb17
-
SHA512
421a0600a1e18354839167c0daa7b2a9e7ce83fc146fc7dd61e000c6e2b96253fccf13dd21384e843d17f6e0f31bc8452fea653ac3c578ccb27c31aee8d2483e
-
SSDEEP
3072:AixYRIgVFK9cJx2I87ZMGCDaZqZu9E/gLAE/OwtJBdw:AixYVVQ9G2I8ZMGjZqY9EiAcB6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource qbot_v5.dll
Files
-
qbot_v5.dll.dll windows:6 windows x64 arch:x64
789c53ebcdd61ea852f1cdb7eccc4af7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
msvcrt
strcmp
_snprintf
_errno
memset
vsnprintf
_strtoi64
memchr
_time64
strncpy
strchr
strtod
localeconv
_vsnwprintf
qsort
atol
memcpy
kernel32
FindNextFileW
GetTickCount
SetThreadPriority
FlushFileBuffers
LocalAlloc
GetExitCodeProcess
GetFileAttributesW
MultiByteToWideChar
SetCurrentDirectoryA
Sleep
lstrcmpiW
GetDriveTypeW
GetLastError
CreateDirectoryW
lstrcat
lstrcmp
CreateMutexW
GetCurrentThread
GetProcessId
GetNumberFormatA
DisconnectNamedPipe
MoveFileW
ExitThread
K32GetModuleFileNameExW
GetCurrentProcessId
SwitchToThread
GetModuleHandleA
GetProcAddress
HeapCreate
HeapFree
HeapAlloc
LoadLibraryA
GetCurrentProcess
lstrcatW
WideCharToMultiByte
FindFirstFileW
GetSystemTimeAsFileTime
SetFileAttributesW
lstrlenW
LoadLibraryW
FreeLibrary
GetCommandLineW
GetVersionExA
GetSystemInfo
GetCurrentDirectoryW
GetWindowsDirectoryW
user32
CharUpperBuffA
CharUpperBuffW
shell32
CommandLineToArgvW
ole32
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
oleaut32
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayDestroy
VariantClear
SysFreeString
SysAllocString
Exports
Exports
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ