qakbot | 1132-55-0x00000000007C0000-0x00000000007E3000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1132-55-0x00000000007C0000-0x00000000007E3000-memory.dmp
Size 140KB
Sample240302-rsnn3aee49
SHA256 0a9481a414ad1d925c6451b1fbd71e392913d29bf67c76c738385c6f070c3e69
MD5 59dcd50342667987f8a4db807c7a6332
SHA1 4b64ac95baa609dbf217f4fe4e70c315fdafb1dd
SHA512 274fb038ade388983835a8517ec0eb53c04774c1fd86b48693cadfadb29bc8b11951d5a0cd00aba5b5c7db078c0d4edb64f697c94b8b9cdcc3d9391bbc82210e
SSDEEP 3072:w/RvTz06+hBObWcRJOAmJ3L/jYTBffLnEnsFm:C+hGWc7mJb/jYTB3LGsF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bb18 1678346091 qakbot

Malware Config

Extracted

Family

qakbot

Version

404.226

Botnet

BB18

Campaign

1678346091

114.143.176.235:443
92.154.17.149:2222
2.14.45.117:2222
84.108.200.161:443
109.11.175.42:2222
88.126.94.4:50000
87.202.101.164:50000
50.68.204.71:995
49.245.82.178:2222
12.172.173.82:32101
190.11.198.76:443
79.67.165.149:995
115.87.227.49:443
84.215.202.22:443
118.250.110.98:995
66.131.25.6:443
80.1.152.201:443
198.2.51.242:993
151.48.158.236:443
50.68.204.71:993
85.61.165.153:2222
84.35.26.14:995
197.92.136.122:443
174.4.89.3:443
187.199.103.21:32103
98.37.25.99:443
184.153.132.82:443
85.59.61.52:2222
103.231.216.238:443
162.248.14.107:443
50.68.186.195:443
2.82.8.80:443
74.92.243.113:50000
80.47.61.240:2222
108.190.203.42:995
24.69.84.237:443
184.176.110.61:61202
12.172.173.82:990
12.172.173.82:465
172.90.139.138:2222
72.80.7.6:50003
50.68.204.71:443
202.186.177.88:443
183.87.163.165:443
12.172.173.82:21
24.239.69.244:443
47.21.51.138:995
174.104.184.149:443
93.147.134.85:443
136.175.69.147:443
12.172.173.82:995
73.165.119.20:443
69.133.162.35:443
12.172.173.82:20
154.246.62.48:993
92.159.173.52:2222
74.66.134.24:443
12.172.173.82:2087
190.75.151.215:2222
94.63.65.146:443
108.44.207.232:443
174.58.146.57:443
116.75.63.136:443
180.151.104.240:443
103.123.223.121:443
103.252.7.231:443
12.172.173.82:22
212.70.107.156:2222
103.111.70.115:995
49.175.72.156:443
72.203.216.98:2222
173.18.126.3:443
86.250.10.160:2222
142.161.27.232:2222
103.42.86.110:995
75.143.236.149:443
91.169.12.198:32100
64.237.221.254:443
103.71.21.107:443
103.140.174.19:2222
172.248.42.122:443
69.164.228.175:443
59.28.84.65:443
184.176.35.223:2222
202.187.95.12:995
201.244.108.183:995
103.111.70.115:443
2.50.50.227:443
27.0.48.233:443
103.141.50.102:995
86.225.214.138:2222
12.172.173.82:50001
75.156.125.215:995
116.72.250.18:443
202.142.98.62:443
47.21.51.138:443
64.229.202.224:995
202.142.98.62:995
125.99.69.178:443
217.165.230.100:2222
82.212.111.148:443
98.145.23.67:443
47.203.229.168:443
77.86.98.236:443
50.67.17.92:443
176.142.207.63:443
73.36.196.11:443
35.143.97.145:995
90.104.22.28:2222
73.22.121.210:443
82.127.204.82:2222
45.50.233.214:443
47.34.30.133:443
24.117.237.157:443
76.170.252.153:995
81.229.117.95:2222
98.163.227.79:443
86.10.146.216:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1132-55-0x00000000007C0000-0x00000000007E3000-memory.dmp

File Explorer

1132-55-0x00000000007C0000-0x00000000007E3000-memory.dmp

.dll 140KB

1132-55-0x00000000007C0000-0x00000000007E3000-memory.dmp

SHA256 0a9481a414ad1d925c6451b1fbd71e392913d29bf67c76c738385c6f070c3e69
MD5 59dcd50342667987f8a4db807c7a6332
SHA1 4b64ac95baa609dbf217f4fe4e70c315fdafb1dd
SHA512 274fb038ade388983835a8517ec0eb53c04774c1fd86b48693cadfadb29bc8b11951d5a0cd00aba5b5c7db078c0d4edb64f697c94b8b9cdcc3d9391bbc82210e
SSDEEP 3072:w/RvTz06+hBObWcRJOAmJ3L/jYTBffLnEnsFm:C+hGWc7mJb/jYTB3LGsF
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths