qakbot | 1712-55-0x0000000000880000-0x00000000008A3000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1712-55-0x0000000000880000-0x00000000008A3000-memory.dmp
Size 140KB
Sample240302-qxtkfadh41
SHA256 a11a5f89aaca1189d9566dcb68b0052cb0da892769e2e71f5d4a8e558b9f582e
MD5 f3bf61366414ec48602682515bee7366
SHA1 aea7e500a3bdf3f29a98a83ac1309f0f8ced2a50
SHA512 80b876f205b3ffd17ce82eb45ac7df7040dec76318e7c8fd9b3326cf3650059bd83264bf921a4c748ebc1308433d3baa2f39457b62c80ad2aea10f43b7dd0ba0
SSDEEP 3072:8P9TnzYqMf5ndgq891iAmJjVRCA3stwTBffnXEns3pm:mi5uqcnmJZRCA3awTB3n2sZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bb18 1678346091 qakbot

Malware Config

Extracted

Family

qakbot

Version

404.226

Botnet

BB18

Campaign

1678346091

114.143.176.235:443
92.154.17.149:2222
2.14.45.117:2222
84.108.200.161:443
109.11.175.42:2222
88.126.94.4:50000
87.202.101.164:50000
50.68.204.71:995
49.245.82.178:2222
12.172.173.82:32101
190.11.198.76:443
79.67.165.149:995
115.87.227.49:443
84.215.202.22:443
118.250.110.98:995
66.131.25.6:443
80.1.152.201:443
198.2.51.242:993
151.48.158.236:443
50.68.204.71:993
85.61.165.153:2222
84.35.26.14:995
197.92.136.122:443
174.4.89.3:443
187.199.103.21:32103
98.37.25.99:443
184.153.132.82:443
85.59.61.52:2222
103.231.216.238:443
162.248.14.107:443
50.68.186.195:443
2.82.8.80:443
74.92.243.113:50000
80.47.61.240:2222
108.190.203.42:995
24.69.84.237:443
184.176.110.61:61202
12.172.173.82:990
12.172.173.82:465
172.90.139.138:2222
72.80.7.6:50003
50.68.204.71:443
202.186.177.88:443
183.87.163.165:443
12.172.173.82:21
24.239.69.244:443
47.21.51.138:995
174.104.184.149:443
93.147.134.85:443
136.175.69.147:443
12.172.173.82:995
73.165.119.20:443
69.133.162.35:443
12.172.173.82:20
154.246.62.48:993
92.159.173.52:2222
74.66.134.24:443
12.172.173.82:2087
190.75.151.215:2222
94.63.65.146:443
108.44.207.232:443
174.58.146.57:443
116.75.63.136:443
180.151.104.240:443
103.123.223.121:443
103.252.7.231:443
12.172.173.82:22
212.70.107.156:2222
103.111.70.115:995
49.175.72.156:443
72.203.216.98:2222
173.18.126.3:443
86.250.10.160:2222
142.161.27.232:2222
103.42.86.110:995
75.143.236.149:443
91.169.12.198:32100
64.237.221.254:443
103.71.21.107:443
103.140.174.19:2222
172.248.42.122:443
69.164.228.175:443
59.28.84.65:443
184.176.35.223:2222
202.187.95.12:995
201.244.108.183:995
103.111.70.115:443
2.50.50.227:443
27.0.48.233:443
103.141.50.102:995
86.225.214.138:2222
12.172.173.82:50001
75.156.125.215:995
116.72.250.18:443
202.142.98.62:443
47.21.51.138:443
64.229.202.224:995
202.142.98.62:995
125.99.69.178:443
217.165.230.100:2222
82.212.111.148:443
98.145.23.67:443
47.203.229.168:443
77.86.98.236:443
50.67.17.92:443
176.142.207.63:443
73.36.196.11:443
35.143.97.145:995
90.104.22.28:2222
73.22.121.210:443
82.127.204.82:2222
45.50.233.214:443
47.34.30.133:443
24.117.237.157:443
76.170.252.153:995
81.229.117.95:2222
98.163.227.79:443
86.10.146.216:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1712-55-0x0000000000880000-0x00000000008A3000-memory.dmp

File Explorer

1712-55-0x0000000000880000-0x00000000008A3000-memory.dmp

.dll 140KB

1712-55-0x0000000000880000-0x00000000008A3000-memory.dmp

SHA256 a11a5f89aaca1189d9566dcb68b0052cb0da892769e2e71f5d4a8e558b9f582e
MD5 f3bf61366414ec48602682515bee7366
SHA1 aea7e500a3bdf3f29a98a83ac1309f0f8ced2a50
SHA512 80b876f205b3ffd17ce82eb45ac7df7040dec76318e7c8fd9b3326cf3650059bd83264bf921a4c748ebc1308433d3baa2f39457b62c80ad2aea10f43b7dd0ba0
SSDEEP 3072:8P9TnzYqMf5ndgq891iAmJjVRCA3stwTBffnXEns3pm:mi5uqcnmJZRCA3awTB3n2sZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths