Overview

overview

10

Static

static

10

620-133-0x...ry.dll

windows7-x64

1

620-133-0x...ry.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    620-133-0x0000000001520000-0x0000000001544000-memory.dmp

  • Size

    144KB

  • MD5

    d5b439628238a3a13de21193fdbebb5b

  • SHA1

    b55fcdb67dc299bc920f4f2a4623a002f0f12d46

  • SHA256

    d7828ef8690949d656c83390d3a76addf7daf3db45ab071dbd5e5e8a48887622

  • SHA512

    d0ff0868fc197b2c6554baef702c54db586e2eedbbbab1798d5d8078f408a1a9ff596f7f7cbed693f37c8cc519518076e59f066208f113b09544e02f07110723

  • SSDEEP

    3072:MzwUtG96KAmroClmAyJA9VQATBfPqZzho:EtwLAIouDyJGVQATBHql

Score
10/10
bb221680686988qakbot

Malware Config

Extracted

Family

qakbot

Version

404.909

Botnet

BB22

Campaign

1680686988

C2

88.126.94.4:50000

104.35.24.154:443

147.219.4.194:443

105.102.30.255:443

139.226.47.229:995

71.171.83.69:443

45.50.233.214:443

92.154.17.149:2222

59.153.96.4:443

75.109.111.89:443

125.99.76.102:443

47.205.25.170:443

12.172.173.82:995

102.158.82.17:443

92.20.199.185:2222

24.236.90.196:2078

116.74.164.148:443

37.14.229.220:2222

98.37.25.99:443

43.243.215.206:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot family
    qakbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 620-133-0x0000000001520000-0x0000000001544000-memory.dmp
    .dll windows:6 windows x86 arch:x86


    Headers

    Sections