qakbot | e70271f34d060cd4a2e7adb2fbb7c103

Sharing

Copy URL Twitter E-mail

General

Target
e70271f34d060cd4a2e7adb2fbb7c103
Size 196KB
Sample240209-l8a51sca75
SHA256 268313dea6a974871d0ea2ff8c2a404ee4479b3c0e043c858baaf98d208a2bb3
MD5 e70271f34d060cd4a2e7adb2fbb7c103
SHA1 a4afd5f8039cf9d018a8effe3f4900f3ba4ab1a2
SHA512 8840d2b180c7356bcb25db9bdb089e1b496aa93617c582bb171dcec53221b1f4483743d373887368365b6834ce266ed51065759e3e3f9f33dd6fd632998e8789
SSDEEP 6144:YyvLH5hV0pO9Rr9c3ZPQFP3bO3OTBCxh+W:BbVQO9Tc2FTO3OTcH+W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

abc112 1608025881 qakbot

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

abc112

Campaign

1608025881

149.28.98.196:995
149.28.99.97:995
45.63.107.192:2222
144.202.38.185:995
144.202.38.185:443
45.63.107.192:995
5.13.84.186:995
68.83.89.188:443
67.141.11.98:443
219.76.148.249:443
86.245.82.249:2078
116.240.78.45:995
37.182.244.124:2222
72.186.1.237:443
78.97.207.104:443
80.14.22.234:2222
202.141.225.158:443
72.28.255.159:995
37.6.208.105:2222
161.142.217.62:443
188.253.85.49:995
217.165.3.30:443
90.61.38.208:2222
2.49.219.254:22
124.29.232.108:443
2.50.143.154:2222
2.50.2.216:443
197.161.154.132:443
103.76.160.110:443
51.223.138.251:443
102.185.13.89:443
85.101.187.146:443
92.154.83.96:2087
45.118.216.157:443
86.122.248.164:2222
92.154.83.96:1194
217.165.125.217:443
92.154.83.96:2078
85.105.29.218:443
151.60.38.21:443
156.213.217.254:443
2.50.57.224:443
217.162.149.212:443
182.161.6.57:3389
24.27.82.216:2222
37.166.181.234:0
45.77.115.208:2222
203.106.116.190:443
85.52.72.32:2222
2.51.240.250:995
2.91.9.248:443
101.109.175.33:443
41.228.47.147:443
78.101.199.138:995
125.63.101.62:443
90.53.103.26:2222
86.124.93.144:443
79.114.177.162:993
5.2.212.254:443
86.127.22.190:443
81.133.234.36:2222
5.15.109.245:443
37.130.115.124:443
2.50.88.125:995
62.38.114.12:2222
78.181.19.134:443
187.155.59.73:443
102.187.95.88:443
79.129.216.215:2222
141.237.135.194:443
42.117.61.10:443
93.148.241.179:2222
41.205.16.222:443
46.53.2.70:443
151.61.125.180:2222
151.73.121.136:443
176.181.247.197:443
149.28.101.90:8443
2.7.69.217:2222
84.117.176.32:443
109.205.204.229:2222
184.179.14.130:22
203.106.195.67:443
121.58.199.24:443
216.201.162.158:443
83.110.13.182:2222
172.87.157.235:3389
45.118.65.34:443
79.129.252.62:2222
2.50.30.147:995
2.50.159.104:2222
105.198.236.101:443
78.96.199.79:443
217.133.54.140:32100
172.91.19.192:443
196.204.207.111:443
77.132.113.187:2222
185.163.221.77:2222
197.49.240.8:995
45.77.115.208:8443
108.30.125.94:443
213.60.147.140:443
217.165.9.48:443
94.70.36.227:2222
59.99.36.20:443
104.37.20.207:995
5.193.106.230:2078
117.215.198.5:443
2.50.49.18:22
2.88.1.76:995
66.25.168.167:2222
173.21.10.71:2222
106.250.150.98:443
58.152.9.133:443
72.36.59.46:2222
89.137.211.239:995
96.241.66.126:443
93.86.1.159:995
95.76.27.6:443
217.128.117.218:2222
37.211.23.45:995
120.150.34.178:443
86.120.138.232:443
41.97.125.168:443
87.27.110.90:2222
82.76.47.211:443
94.69.242.254:2222
90.101.62.189:2222
78.187.125.116:2222
197.57.96.163:443
197.90.131.100:32100
5.193.178.36:2078
196.151.252.84:443
118.100.159.27:443
105.198.236.99:443
185.105.131.233:443
45.77.115.208:443
83.194.193.247:2222
41.233.152.232:993
197.45.110.165:995
86.97.221.121:443
78.154.31.238:443
37.21.231.245:995
108.190.194.146:2222
45.250.69.150:443
178.88.228.231:995
83.110.109.78:2222
85.204.189.105:443
198.2.35.226:2222
37.107.76.36:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e70271f34d060cd4a2e7adb2fbb7c103

File Explorer

e70271f34d060cd4a2e7adb2fbb7c103

.dll 196KB

e70271f34d060cd4a2e7adb2fbb7c103

IMPHASH a89679aec70fab3dbac762460558a4bc
SHA256 268313dea6a974871d0ea2ff8c2a404ee4479b3c0e043c858baaf98d208a2bb3
MD5 e70271f34d060cd4a2e7adb2fbb7c103
SHA1 a4afd5f8039cf9d018a8effe3f4900f3ba4ab1a2
SHA512 8840d2b180c7356bcb25db9bdb089e1b496aa93617c582bb171dcec53221b1f4483743d373887368365b6834ce266ed51065759e3e3f9f33dd6fd632998e8789
SSDEEP 6144:YyvLH5hV0pO9Rr9c3ZPQFP3bO3OTBCxh+W:BbVQO9Tc2FTO3OTcH+W
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

inet_ntoa

psapi

GetModuleFileNameExW

msvcrt

_time64 strtod _HUGE localeconv strchr strncpy malloc free qsort memcpy memmove memset atol _vsnwprintf _snprintf _vsnprintf _strtoi64 memchr _errno

kernel32

lstrcmpA lstrlenA lstrcpynA GetCurrentProcess GetCurrentThread MultiByteToWideChar GetExitCodeThread GetOEMCP CreateMutexA DuplicateHandle GetCurrentProcessId GetLastError lstrcatA CreateDirectoryW DisconnectNamedPipe lstrcpynW GetProcessId CopyFileW lstrcatW DeleteFileW lstrcpyW lstrcmpiW CloseHandle GetDriveTypeW GetModuleHandleA lstrlenW MoveFileW GetProcAddress SwitchToThread InterlockedIncrement SetThreadPriority HeapAlloc HeapFree HeapCreate WideCharToMultiByte FreeLibrary GetSystemTimeAsFileTime SetLastError lstrcmpiA LoadLibraryA GetExitCodeProcess CreatePipe GetWindowsDirectoryW FindFirstFileW FindNextFileW SetFileAttributesW FlushFileBuffers LocalAlloc LoadLibraryW GetTickCount GetModuleFileNameW GetSystemInfo GetVersionExA

user32

CreateWindowExA CharUpperBuffW CharUpperBuffA GetSystemMetrics RegisterClassExA DestroyWindow DefWindowProcA UnregisterClassA

advapi32

GetSidSubAuthority OpenProcessToken RegSetValueExW RegQueryValueExW IsTextUnicode RegDeleteValueA RegOpenKeyExW RegEnumValueW RegDeleteValueW RegQueryInfoKeyW RegUnLoadKeyW RegLoadKeyW ConvertSidToStringSidW OpenThreadToken GetSidSubAuthorityCount GetTokenInformation LookupAccountNameW LookupAccountSidW GetSecurityDescriptorSacl SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor

ole32

CoInitializeEx CoInitializeSecurity CoCreateInstance CoSetProxyBlanket

oleaut32

SafeArrayGetUBound SysAllocString SysFreeString SafeArrayGetElement SafeArrayDestroy VariantClear SafeArrayGetLBound

userenv

GetUserProfileDirectoryW