qakbot | qakbot[.]sc[.]3[.]dll[.]exe

Resubmissions

21-05-2024 17:23

240521-vydmtsch7x 10

24-04-2024 14:44

240424-r35qbsbg9x 10

Sharing

Copy URL

Twitter E-mail

General

Target

qakbot.sc.3.dll.exe
Size

169KB
MD5

362978ed1c1eec5ff19b744601e082a2
SHA1

9c9e834e1c38a50fc6cb3ceef4963a4a0026d5af
SHA256

af6a9b7e7aefeb903c76417ed2b8399b73657440ad5f8b48a25cfe5e97ff868f
SHA512

45fe028cfa92a88e86d5a354b84227b20f41254463a0b43328fc1a5e914e9e34bb42ef7d10e55972a24cf0a8c7b5b30045186bca5e9e0bc94fecb0e301b2e44e
SSDEEP

3072:QMpYuPV2KxPQSDYGQHKLDg5wF1L0D9goAP9TyjCyB5fS:QfuYMPQSDmHaDHF14DfA1yCyBlS

Score

10^/10

qakbot

Malware Config

Signatures

Detect Qakbot Payload 1 IoCs

Processes:

resource yara_rule

sample family_qakbot_v5
Qakbot family
qakbot
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

qakbot.sc.3.dll.exe

resource	yara_rule
sample	family_qakbot_v5

resource
qakbot.sc.3.dll.exe

Files

qakbot.sc.3.dll.exe
.dll windows:6 windows x64 arch:x64

a5864330cc4bfd0882fb2f3679901037

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

strcmp
_snprintf
_errno
memset
_vsnprintf
_strtoi64
memchr
_time64
strncpy
strchr
strtod
localeconv
_vsnwprintf
qsort
atol
memcpy

kernel32

SetFileAttributesW
GetTickCount
SetThreadPriority
FlushFileBuffers
LocalAlloc
GetExitCodeProcess
GetFileAttributesW
MultiByteToWideChar
SetCurrentDirectoryA
Sleep
lstrcmpiW
GetDriveTypeW
GetLastError
CreateDirectoryW
lstrcatA
lstrcmpA
CreateMutexW
GetCurrentThread
GetProcessId
GetNumberFormatA
DisconnectNamedPipe
MoveFileW
ExitThread
GetCurrentProcessId
SwitchToThread
GetModuleHandleA
GetProcAddress
HeapCreate
HeapFree
HeapAlloc
LoadLibraryA
GetCurrentProcess
lstrcatW
WideCharToMultiByte
FindFirstFileW
FindNextFileW
GetSystemTimeAsFileTime
lstrlenW
LoadLibraryW
FreeLibrary
GetCommandLineW
GetVersionExA
GetSystemInfo
GetCurrentDirectoryW
GetWindowsDirectoryW

user32

CharUpperBuffA
CharUpperBuffW

shell32

CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity

oleaut32

SafeArrayGetLBound
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayDestroy
VariantClear
SysFreeString
SysAllocString

Exports

Exports

CfGetPlatformInfo

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

a5864330cc4bfd0882fb2f3679901037

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 128KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 17KB

.pdata Size: 5KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 68B

.text
Size: 128KB - Virtual size: 128KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 17KB

.pdata
Size: 5KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 68B