qakbot | 1448-54-0x0000000010000000-0x0000000010024000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1448-54-0x0000000010000000-0x0000000010024000-memory.dmp
Size 144KB
Sample240305-dn49csda6x
SHA256 c751e158be7e0a72c275cede577b7aab8ab8c8344883fc584fab9c37e9d8f5a5
MD5 989edcfc3d75290ec666030aaac7298d
SHA1 011f73fd50c25fecc1b8c87f6c0e8ab17bd820db
SHA512 448d241d073226ef45df489a60b8bbb884968a5a2f4c2bf49c02b8d63b85e40b55f49a4b3ff346fd51b7d657478ed33aebe80a96060cf6f9c198276991750578
SSDEEP 3072:buUtexa1mQ4GH6MlnzXFAEJjsVVH2F8TBffGWpnL:b3teP/GaMlT2EJ4VVH2F8TB3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bb23 1681291772 qakbot

Malware Config

Extracted

Family

qakbot

Version

404.919

Botnet

BB23

Campaign

1681291772

101.184.134.98:2222
23.30.22.225:993
104.35.24.154:443
85.2.185.70:2222
14.192.241.76:995
47.196.225.236:443
78.92.133.215:443
176.202.45.209:443
174.118.63.123:443
84.35.26.14:995
86.171.191.31:443
103.141.50.79:995
213.67.139.53:2222
172.115.17.50:443
198.2.51.242:993
69.133.162.35:443
58.162.223.233:443
91.169.12.198:32100
47.21.51.138:443
35.143.97.145:995
12.172.173.82:32101
64.121.161.102:443
70.28.50.223:1194
49.245.95.124:2222
70.28.50.223:3389
65.190.242.244:443
102.158.69.237:443
72.205.104.134:443
103.42.86.42:995
108.32.72.145:443
70.28.50.223:2087
24.236.90.196:2078
14.200.181.108:443
91.165.188.74:50000
122.184.143.83:443
78.192.109.105:2222
50.68.204.71:443
161.142.103.5:995
213.91.235.146:443
95.60.243.61:995
50.68.204.71:993
72.134.124.16:443
71.31.232.65:995
99.228.131.116:2222
50.68.186.195:443
90.4.110.221:2222
125.99.76.102:443
75.143.236.149:443
85.241.180.94:443
209.93.207.224:2222
109.50.143.218:2222
139.226.47.229:995
43.243.215.210:443
103.78.55.136:443
76.170.252.153:995
70.28.50.223:2083
86.180.120.159:2222
184.153.132.82:443
90.104.151.37:2222
84.155.13.118:995
71.31.100.192:443
98.145.23.67:443
77.126.185.173:443
12.172.173.82:993
70.112.206.5:443
24.206.27.39:443
86.99.79.136:2222
178.175.187.254:443
90.55.106.37:2222
86.98.23.66:443
125.99.69.178:443
92.9.45.20:2222
23.30.22.225:50003
79.77.142.22:2222
98.37.25.99:443
37.166.25.168:21
122.186.210.254:443
184.176.35.223:2222
136.244.25.165:443
86.45.66.141:2222
12.172.173.82:20
27.109.19.90:2078
162.248.14.107:443
109.159.118.107:2222
79.42.241.244:443
88.122.133.88:32100
212.70.98.78:2222
116.72.250.18:443
74.66.134.24:443
23.30.22.225:443
151.62.160.232:443
136.232.184.134:995
76.80.180.154:993
92.189.214.236:2222
78.159.145.17:995
86.225.214.138:2222
88.126.94.4:50000
96.87.28.170:2222
74.92.243.115:50000
72.200.109.104:443
75.109.111.89:443
157.119.85.203:443
201.244.108.183:995
86.130.9.222:2222
71.171.83.69:443
68.173.170.110:8443
47.205.25.170:443
89.129.109.27:2222
92.239.81.124:443
172.248.42.122:443
71.38.155.217:443
172.90.139.138:2222
41.227.217.128:443
92.149.250.113:2222
12.172.173.82:50001
12.172.173.82:22
213.240.106.71:995
105.184.209.37:995
12.172.173.82:2087
107.146.12.26:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1448-54-0x0000000010000000-0x0000000010024000-memory.dmp

File Explorer

1448-54-0x0000000010000000-0x0000000010024000-memory.dmp

.dll 144KB

1448-54-0x0000000010000000-0x0000000010024000-memory.dmp

SHA256 c751e158be7e0a72c275cede577b7aab8ab8c8344883fc584fab9c37e9d8f5a5
MD5 989edcfc3d75290ec666030aaac7298d
SHA1 011f73fd50c25fecc1b8c87f6c0e8ab17bd820db
SHA512 448d241d073226ef45df489a60b8bbb884968a5a2f4c2bf49c02b8d63b85e40b55f49a4b3ff346fd51b7d657478ed33aebe80a96060cf6f9c198276991750578
SSDEEP 3072:buUtexa1mQ4GH6MlnzXFAEJjsVVH2F8TBffGWpnL:b3teP/GaMlT2EJ4VVH2F8TB3
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths