qakbot | 3460-134-0x0000000010000000-0x0000000010023000-memory[.]dmp

Resubmissions

02/03/2024, 10:38

240302-mpj49ace3y10

02/03/2024, 06:52

240302-hm9jxabc9110

Sharing

Copy URL Twitter E-mail

General

Target
3460-134-0x0000000010000000-0x0000000010023000-memory.dmp
Size 140KB
Sample240302-hm9jxabc91
SHA256 93646a5c48ea03eff9767ec6fcacea0799f449296d031524832adff217ad284d
MD5 bbb6c0031fd09c75e9c8e6921ee69142
SHA1 42d77b2fc9938b9b9ecc0e7ad0aacf4508caff39
SHA512 bd1ea2f965c18f2b840318b985c86b63b7c46f782f8e3c7c6758b3bf85d7e0bcff9dafe06da37564c7ae990a79145b4d5552cfbfa8f7fc093580f30f0c2d9f1b
SSDEEP 3072:YKUR+AIznCp7BQCrZJzSWjsdA0Jl0ns9p8TBfPVo/lo:YbIznCVKCtcWjs+0J6nK8TBHVo/S
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bb15 1676367197 qakbot

Malware Config

Extracted

Family

qakbot

Version

404.506

Botnet

BB15

Campaign

1676367197

85.61.165.153:2222
12.172.173.82:995
73.161.176.218:443
213.67.255.57:2222
81.157.227.223:2222
95.94.41.77:2222
75.143.236.149:443
213.31.90.183:2222
85.241.180.94:443
98.145.23.67:443
122.184.143.82:443
71.52.53.166:443
162.248.14.107:443
190.206.75.58:2222
86.169.203.116:443
82.127.204.82:2222
47.21.51.138:995
75.98.154.19:443
45.246.235.113:995
91.68.227.219:443
86.207.227.152:2222
78.218.230.28:443
87.221.197.113:2222
91.165.188.74:50000
174.104.184.149:443
86.138.7.220:2222
67.187.130.101:443
12.172.173.82:2087
58.247.115.126:995
73.165.119.20:443
90.104.22.28:2222
74.33.196.114:443
121.121.100.207:995
12.172.173.82:20
116.72.250.18:443
172.248.42.122:443
85.85.34.201:993
2.13.73.146:2222
31.53.29.145:2222
103.123.223.76:443
71.112.212.166:443
92.27.86.48:2222
46.24.103.218:2078
93.24.192.142:20
176.142.207.63:443
217.128.91.196:2222
12.172.173.82:465
89.129.109.27:2222
50.68.204.71:993
12.172.173.82:21
12.172.173.82:990
47.34.30.133:443
197.26.145.223:443
24.71.120.191:443
87.223.82.41:443
72.200.109.104:443
94.59.56.206:2222
84.35.26.14:995
24.239.69.244:443
68.108.122.180:443
70.64.77.115:443
161.142.107.68:995
173.18.126.3:443
45.50.233.214:443
103.212.19.254:995
217.165.186.116:2222
136.232.184.134:995
2.50.48.213:443
93.147.235.8:443
217.128.200.114:2222
92.186.69.229:2222
91.170.115.68:32100
86.130.9.232:2222
64.237.185.60:443
86.202.48.142:2222
104.35.24.154:443
59.28.84.65:443
86.225.214.138:2222
107.146.12.26:2222
74.92.243.113:50000
73.36.196.11:443
88.126.112.14:50000
87.202.101.164:50000
27.0.48.205:443
103.144.201.53:2078
47.21.51.138:443
67.10.175.47:2222
84.108.200.161:443
103.252.7.231:443
201.244.108.183:995
103.192.80.173:995
190.11.198.75:443
98.37.25.99:443
70.160.80.210:443
82.212.119.21:443
205.164.227.222:443
27.109.19.90:2078
88.126.94.4:50000
41.97.10.62:443
86.250.12.217:2222
92.154.17.149:2222
188.49.125.169:995
184.176.35.223:2222
86.195.14.72:2222
216.228.41.244:2222
103.42.86.110:995
147.219.4.194:443
89.32.157.195:995
79.67.165.149:995
76.80.180.154:995
182.180.105.242:443
136.244.25.165:443
87.149.176.97:443
83.7.55.221:443
69.133.162.35:443
184.68.116.146:2222
184.68.116.146:3389
184.68.116.146:2078

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3460-134-0x0000000010000000-0x0000000010023000-memory.dmp

File Explorer

3460-134-0x0000000010000000-0x0000000010023000-memory.dmp

.dll 140KB

3460-134-0x0000000010000000-0x0000000010023000-memory.dmp

SHA256 93646a5c48ea03eff9767ec6fcacea0799f449296d031524832adff217ad284d
MD5 bbb6c0031fd09c75e9c8e6921ee69142
SHA1 42d77b2fc9938b9b9ecc0e7ad0aacf4508caff39
SHA512 bd1ea2f965c18f2b840318b985c86b63b7c46f782f8e3c7c6758b3bf85d7e0bcff9dafe06da37564c7ae990a79145b4d5552cfbfa8f7fc093580f30f0c2d9f1b
SSDEEP 3072:YKUR+AIznCp7BQCrZJzSWjsdA0Jl0ns9p8TBfPVo/lo:YbIznCVKCtcWjs+0J6nK8TBHVo/S
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths