qakbot | 20efcddcbdd32c1b9648a4d50d2a29bb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
20efcddcbdd32c1b9648a4d50d2a29bb_JaffaCakes118
Size 221KB
Sample240507-swclmsda2v
SHA256 fd1e4ecef5aed84a1e9cf04271111c5041d6c50c850b75959932927cf875293a
MD5 20efcddcbdd32c1b9648a4d50d2a29bb
SHA1 b36284f8d8f3a193ef9f0aa2465eee0deca99d94
SHA512 067da669c2d212537426a4027cfb326216c5fb31f4e2cbbc881dc0a6cf99688a303b076b9256f87243d75b19b73ac475400c4a30da8aa6bacce66bd2c59ca8a4
SSDEEP 6144:afb0rHntqUtSsDWXjU5YVFsWfefYwd8h:hksDMjU5YVaWkd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

spx85 1585321881 qakbot

Malware Config

Extracted

Family

qakbot

Version

324.70

Botnet

spx85

Campaign

1585321881

201.152.111.104:995
181.197.195.138:995
96.35.170.82:2222
50.244.112.10:443
174.126.230.25:443
74.33.70.220:443
72.80.137.215:443
86.121.120.255:443
108.190.151.108:2222
70.166.158.118:443
24.229.245.124:995
71.187.170.235:443
49.191.6.183:995
71.80.45.253:443
46.214.62.199:443
76.107.242.174:443
79.116.229.1:995
31.5.172.53:443
71.172.110.236:443
94.98.82.131:443
73.60.148.209:443
104.235.125.137:443
188.27.27.227:443
97.78.107.14:443
188.26.131.41:443
174.104.23.7:443
47.39.76.74:443
98.27.176.35:443
104.34.122.18:443
104.174.71.153:2222
89.34.231.30:443
173.69.58.179:443
24.184.5.251:2222
79.113.116.216:443
81.245.66.237:995
98.219.77.197:443
207.255.18.67:443
78.97.116.41:443
100.1.239.189:443
208.93.202.49:443
173.63.217.48:443
206.169.163.147:995
73.226.220.56:443
71.197.126.250:443
70.37.212.176:995
72.142.106.198:465
98.190.24.81:443
187.194.16.208:2222
68.116.193.239:443
93.114.89.119:995
85.204.189.105:443
173.173.68.41:443
137.119.71.87:443
24.110.14.40:443
187.19.151.218:995
100.4.185.8:443
72.36.59.46:2222
5.2.149.216:443
83.25.14.84:2222
173.173.1.164:443
72.36.11.22:443
78.97.145.242:443
75.110.250.89:443
190.204.58.240:2078
24.55.152.50:995
46.214.86.45:443
47.202.98.230:443
159.242.41.235:443
70.57.15.187:993
74.105.139.160:443
24.46.40.189:2222
100.38.123.22:443
24.186.50.78:443
67.7.2.109:2222
71.220.222.169:443
72.190.124.29:443
72.218.167.183:995
72.16.212.107:465
173.3.132.17:995
72.190.101.70:443
104.152.16.45:995
70.62.160.186:6883
98.116.62.242:443
74.129.26.223:443
24.201.79.208:2078
85.7.22.186:2222
79.119.74.176:443
67.251.155.12:443
12.5.37.3:443
89.43.208.246:443
78.96.148.177:443
73.169.47.57:443
45.247.216.164:443
24.110.96.149:443
98.118.156.172:443
46.153.111.112:995
184.176.139.8:443
88.158.200.203:443
172.95.42.35:443
86.126.197.176:443
67.165.206.193:995
79.127.79.210:995
73.23.194.75:443
206.255.163.120:443
74.109.200.208:443
65.30.12.240:443
100.40.48.96:443
84.247.55.190:443
89.137.162.193:443
94.59.237.62:995
75.111.145.5:443
68.174.15.223:443
71.182.142.63:443
64.19.74.29:995
63.155.135.211:995
75.82.228.209:443
69.246.151.5:443
47.153.115.154:993
71.77.252.14:2222
24.37.178.158:443
209.213.30.152:443
97.81.255.189:443
72.29.181.77:2078
73.76.47.127:443
47.39.177.171:2222
82.77.166.92:443
95.77.237.115:443
76.23.204.29:443
68.49.120.179:443
98.213.28.175:443
50.244.112.106:443
86.125.180.36:995
72.255.200.129:2222
47.180.66.10:443
72.209.191.27:443
99.229.5.63:995
184.180.157.203:2222
70.191.103.164:443
71.193.126.206:443
5.13.94.54:443
148.75.231.53:443
74.75.237.11:443
181.126.86.223:443
71.226.90.153:443
68.225.250.136:443
75.183.171.155:3389
98.164.253.75:443
50.115.187.139:443
137.99.224.198:443
66.26.160.37:443

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20efcddcbdd32c1b9648a4d50d2a29bb_JaffaCakes118

File Explorer

20efcddcbdd32c1b9648a4d50d2a29bb_JaffaCakes118

.exe 221KB

20efcddcbdd32c1b9648a4d50d2a29bb_JaffaCakes118

IMPHASH 3489ec6897bf25dd7f5d86ee09369d0d
SHA256 fd1e4ecef5aed84a1e9cf04271111c5041d6c50c850b75959932927cf875293a
MD5 20efcddcbdd32c1b9648a4d50d2a29bb
SHA1 b36284f8d8f3a193ef9f0aa2465eee0deca99d94
SHA512 067da669c2d212537426a4027cfb326216c5fb31f4e2cbbc881dc0a6cf99688a303b076b9256f87243d75b19b73ac475400c4a30da8aa6bacce66bd2c59ca8a4
SSDEEP 6144:afb0rHntqUtSsDWXjU5YVFsWfefYwd8h:hksDMjU5YVaWkd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6697

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

GetUserProfileDirectoryW

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoSetProxyBlanket CoInitialize CoInitializeSecurity

shell32

CommandLineToArgvW ShellExecuteW SHGetFolderPathW

setupapi

SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

kernel32

GetLastError GetProcAddress LoadLibraryA lstrcmpiW GetModuleHandleA CloseHandle GetCurrentProcessId GetEnvironmentVariableW lstrlenA WideCharToMultiByte lstrcatA GetEnvironmentVariableA MultiByteToWideChar lstrlenW lstrcatW lstrcpyA HeapAlloc HeapFree HeapCreate VirtualAlloc GetFileSize lstrcmpiA GetModuleFileNameA FindResourceA LoadResource SizeofResource GetThreadContext CreateEventA GetModuleHandleW LoadLibraryW TerminateProcess DeleteFileW ResumeThread ExpandEnvironmentStringsW GetComputerNameW GetVolumeInformationW ReleaseMutex GetExitCodeProcess GetSystemTimeAsFileTime SetEnvironmentVariableW GetTickCount GetModuleFileNameW GetSystemInfo SetEnvironmentVariableA GetVersionExA CopyFileW SetEvent OpenEventA CreateMutexA TerminateThread CreateThread GetFileAttributesA GetFileAttributesW GetCurrentThread LocalAlloc GetLocalTime LocalFree lstrcpyW CreateDirectoryW SleepEx WaitForSingleObject FreeLibrary GetDriveTypeW lstrcmpA GetCommandLineW ExitProcess lstrcpynW Sleep SystemTimeToFileTime GetSystemTime GetCurrentProcess GetWindowsDirectoryW

user32

CharUpperBuffA MessageBoxA GetClassNameA CharUpperBuffW

advapi32

RegOpenKeyExW RegEnumValueW RegDeleteValueW RegQueryInfoKeyW LookupAccountNameW EqualSid SetServiceStatus RegUnLoadKeyW RegLoadKeyW ConvertSidToStringSidW RegSetValueExW RegQueryValueExW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation RegisterServiceCtrlHandlerA StartServiceCtrlDispatcherA RegCloseKey SetFileSecurityW OpenProcessToken GetSidSubAuthority OpenThreadToken GetSidSubAuthorityCount LookupAccountSidW CreateProcessAsUserW

msvcrt

memcpy memset _vsnwprintf _vsnprintf _except_handler3 _ltoa

netapi32

NetApiBufferFree NetUserEnum NetGetDCName