2024-05-24_e072bb229db7832e8957607b37bf249c_mafia_qakbot | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-24_e072bb229db7832e8957607b37bf249c_mafia_qakbot
Size

971KB
MD5

e072bb229db7832e8957607b37bf249c
SHA1

7ad68c5f974565a64264f7f650e4ce92d018fef0
SHA256

12436cf20cf3c5f476ee61e8d8aacb01224d23f2a03f822a407034c7a54dcaa1
SHA512

baf2c937f3970ab4ade06606ee8bc1b1b32515d3bb681bfa6a6dc0018235906b5389dac24b9ec603e595ec4a5167d1c6b1c04478ee165480fab7e3552e8f70cd
SSDEEP

24576:pGmj8GFiYBcNDDot26QkBqbVJS04SUj8xnHb+v+:pGmg/lDtx/D4SY+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_e072bb229db7832e8957607b37bf249c_mafia_qakbot

Files

2024-05-24_e072bb229db7832e8957607b37bf249c_mafia_qakbot
.exe windows:5 windows x86 arch:x86

06fa29813db6c1f98441703604fe5cf8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualProtect
ExitProcess

Sections

.text
Size: 578KB - Virtual size: 577KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ