qakbot | 1964-54-0x0000000010000000-0x0000000010023000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1964-54-0x0000000010000000-0x0000000010023000-memory.dmp
Size 140KB
Sample240302-ymnkfahc93
SHA256 bd59b020db3068e59f3350f1b7c090755dad60f4ff5abc086346f94f4a788f76
MD5 d398f3b545e225cfc8efc9da7fd1bca2
SHA1 8aa3ad287d690c8bef11d44397c44ec7566b5e50
SHA512 034e7c3958f691160fb5c859ce585284b2f48ecf65652883ad54b06ad8218f56dc4fa78a2b9b3b2322c8cec763b07890ffcbb68d9211aa06d1b099ad7b7c2e35
SSDEEP 3072:UjPR4nxKRttVbYKAk67CERzMRAPJyDnYMTBfPuq:UHRxbYK0CEMaPJynYMTBHN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bb19 1678819882 qakbot

Malware Config

Extracted

Family

qakbot

Version

404.263

Botnet

BB19

Campaign

1678819882

162.248.14.107:443
89.32.159.107:995
50.68.186.195:443
50.68.204.71:443
24.69.84.237:443
92.239.81.124:443
149.74.159.67:2222
176.202.46.81:443
2.82.8.80:443
72.203.216.98:2222
73.22.121.210:443
190.218.125.145:443
76.71.137.91:2222
81.158.112.20:2222
190.191.35.122:443
12.172.173.82:993
98.145.23.67:443
12.172.173.82:22
37.186.55.60:2222
73.161.176.218:443
78.196.246.32:443
12.172.173.82:995
173.18.126.3:443
201.244.108.183:995
24.178.201.230:2222
76.27.40.189:443
173.176.4.133:443
86.225.214.138:2222
74.66.134.24:443
213.31.90.183:2222
12.172.173.82:50001
202.187.87.178:995
78.247.21.20:443
70.53.96.223:995
75.156.125.215:995
186.48.181.17:995
193.92.214.52:995
65.95.49.237:2222
186.64.67.54:443
90.104.22.28:2222
189.222.53.217:443
122.184.143.84:443
92.159.173.52:2222
70.121.198.103:2078
97.90.245.22:443
64.123.103.123:443
86.130.9.213:2222
190.75.139.66:2222
91.68.227.219:443
78.19.1.3:443
31.190.219.141:443
213.67.255.57:2222
178.175.187.254:443
109.145.96.251:2222
2.14.105.160:2222
208.180.17.32:2222
109.11.175.42:2222
184.189.41.80:443
31.48.18.52:443
103.12.133.134:2222
70.51.152.61:2222
47.203.229.168:443
104.35.24.154:443
190.28.116.106:443
103.169.83.89:443
23.251.92.171:2222
80.107.149.84:2222
73.36.196.11:443
47.196.225.236:443
86.208.35.220:2222
67.253.226.137:995
12.172.173.82:2087
184.176.35.223:2222
92.27.86.48:2222
173.178.151.233:443
83.92.85.93:443
76.80.180.154:995
24.117.237.157:443
35.143.97.145:995
92.1.170.110:995
71.46.234.171:443
82.11.242.219:443
85.241.180.94:443
45.243.162.199:995
76.170.252.153:995
90.165.109.4:2222
173.185.50.218:995
81.229.117.95:2222
174.21.72.135:2222
83.213.192.136:443
50.68.204.71:995
91.165.188.74:50000
47.34.30.133:443
12.172.173.82:465
72.80.7.6:50003
184.153.132.82:443
72.194.232.94:443
86.178.33.20:2222
94.200.183.66:2222
70.55.187.152:2222
69.119.123.159:2222
136.35.241.159:443
72.88.245.71:443
65.94.87.200:2222
49.245.82.178:2222
12.172.173.82:32101
64.237.245.195:443
197.148.17.17:2078
74.93.148.97:995
103.71.21.107:443
71.65.145.108:443
45.50.233.214:443
88.171.156.150:50000
73.165.119.20:443
69.133.162.35:443
12.172.173.82:20
102.159.236.172:443
80.13.205.69:2222
93.147.134.85:443
66.35.125.114:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1964-54-0x0000000010000000-0x0000000010023000-memory.dmp

File Explorer

1964-54-0x0000000010000000-0x0000000010023000-memory.dmp

.dll 140KB

1964-54-0x0000000010000000-0x0000000010023000-memory.dmp

SHA256 bd59b020db3068e59f3350f1b7c090755dad60f4ff5abc086346f94f4a788f76
MD5 d398f3b545e225cfc8efc9da7fd1bca2
SHA1 8aa3ad287d690c8bef11d44397c44ec7566b5e50
SHA512 034e7c3958f691160fb5c859ce585284b2f48ecf65652883ad54b06ad8218f56dc4fa78a2b9b3b2322c8cec763b07890ffcbb68d9211aa06d1b099ad7b7c2e35
SSDEEP 3072:UjPR4nxKRttVbYKAk67CERzMRAPJyDnYMTBfPuq:UHRxbYK0CEMaPJynYMTBHN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths