Overview

overview

10

Static

static

10

1376-56-0x...ry.dll

windows7-x64

1

1376-56-0x...ry.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1376-56-0x00000000002E0000-0x0000000000304000-memory.dmp

  • Size

    144KB

  • MD5

    7e77805b1704f9bfcc11145540004d2f

  • SHA1

    e7c6cfd13a97285d53c22235138cc3332e46780c

  • SHA256

    7788ae17bd36f8986e740e18863b3d03a60f377ae635d76f93ec0201cdaa207d

  • SHA512

    a322d4c24a5b17a3a2b9a9e51908d82be263a989eb30324f89b7659277dbe8f5be0c43cd293acb47d25274db828261dd13b2827e224d4e9bb8c0544ba3569083

  • SSDEEP

    3072:q5EwMls1sTQAEaz3TVNrcjiOApJOh3yoTBfv2N/Tg:8MKsvEafzrWi7pJQ3yoTBn2N0

Score
10/10
bb271683811051qakbot

Malware Config

Extracted

Family

qakbot

Version

404.1038

Botnet

BB27

Campaign

1683811051

C2

113.11.92.30:443

86.130.9.208:2222

27.109.19.90:2078

70.28.50.223:32100

89.129.109.27:2222

12.172.173.82:21

70.28.50.223:2087

200.93.26.107:2222

50.68.204.71:993

12.172.173.82:32101

173.88.135.179:443

70.28.50.223:3389

86.99.48.130:2222

67.219.197.94:443

76.64.99.251:2222

86.250.12.86:2222

136.35.241.159:443

69.157.243.204:2222

216.36.153.248:443

173.176.4.133:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot family
    qakbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1376-56-0x00000000002E0000-0x0000000000304000-memory.dmp
    .dll windows:6 windows x86 arch:x86


    Headers

    Sections