2024-06-13_88763a8d0fde335706c5d1319d6d0b28_qakbot_ryuk_sliver

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-13_88763a8d0fde335706c5d1319d6d0b28_qakbot_ryuk_sliver
Size 7.6MB
Sample240613-a3rd9s1eqk
SHA256 7be4f07258b9993eedda0f32231989b8b9628ba86582cd8f251c49d21d1ee8ae
MD5 88763a8d0fde335706c5d1319d6d0b28
SHA1 e3c85ba3805325b2d1a665ee14cf6b8de1657640
SHA512 39964914af0c6545c1bf5642cefdc5a2b9dcb4b39233955219b70b7ced0785cf48cb81910ef1f37f0e90d70ed4eb44f1463e98c3dc756c4dc76c4e244993ba1e
SSDEEP 98304:IJ4fDchgb8QwlgUjsMpdIl4UwAyBWQhqYUyx6bq8wNRgZxIoG2D3dG:IJ4fDchgbBwrAo44UwTBsYUoVyZxFDNG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-13_88763a8d0fde335706c5d1319d6d0b28_qakbot_ryuk_sliver

.exe 7.6MB

2024-06-13_88763a8d0fde335706c5d1319d6d0b28_qakbot_ryuk_sliver

IMPHASH 495701cfb7eac2043edbbc52c82c2f6a
SHA256 7be4f07258b9993eedda0f32231989b8b9628ba86582cd8f251c49d21d1ee8ae
MD5 88763a8d0fde335706c5d1319d6d0b28
SHA1 e3c85ba3805325b2d1a665ee14cf6b8de1657640
SHA512 39964914af0c6545c1bf5642cefdc5a2b9dcb4b39233955219b70b7ced0785cf48cb81910ef1f37f0e90d70ed4eb44f1463e98c3dc756c4dc76c4e244993ba1e
SSDEEP 98304:IJ4fDchgb8QwlgUjsMpdIl4UwAyBWQhqYUyx6bq8wNRgZxIoG2D3dG:IJ4fDchgbBwrAo44UwTBsYUoVyZxFDNG
MD5 SHA1 SHA512 SSDEEP

Digest

03:2e:c2:5a:01:80:17:1c:77:75:b3:52:d0:b6:31:75:db:ab:d4:93

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Veriato\, Inc.,O=Veriato\, Inc.,L=West Palm Beach,ST=Florida,C=US

Chains

Jun 12, 2024

CN=Veriato\, Inc.,O=Veriato\, Inc.,L=West Palm Beach,ST=Florida,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

Major OS version

Entry point

2211904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ClientService64.pdb

iphlpapi

GetTcp6Table2 GetTcpTable2

netapi32

DsRoleFreeMemory DsRoleGetPrimaryDomainInformation

secur32

GetUserNameExA

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSQueryUserToken WTSEnumerateSessionsW

advapi32

CryptSignHashW CryptDestroyHash CryptAcquireContextW CryptReleaseContext CryptCreateHash RegEnumValueA CryptDecrypt RegSetValueExA RegQueryValueExA RegOpenKeyExA OpenProcessToken CreateProcessAsUserA AdjustTokenPrivileges DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf SetFileSecurityA ConvertStringSecurityDescriptorToSecurityDescriptorA LookupAccountSidW GetSecurityDescriptorSacl RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW SetNamedSecurityInfoA LookupPrivilegeValueW RegEnumKeyExA RegCloseKey RegQueryValueExW RegEnumValueW RegDeleteValueW RegGetValueW RegOpenKeyExW RegSetValueExW RegSetKeySecurity RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegGetKeySecurity SetEntriesInAclW SetSecurityDescriptorGroup MakeSelfRelativeSD GetSecurityDescriptorLength InitializeSecurityDescriptor FreeSid IsValidSecurityDescriptor SetSecurityDescriptorSacl GetSecurityDescriptorControl AllocateAndInitializeSid SetSecurityDescriptorOwner SetSecurityDescriptorDacl RegDeleteValueA LookupAccountNameW ConvertSidToStringSidW CryptEnumProvidersW RegDeleteKeyA RegCreateKeyExA CloseServiceHandle QueryServiceStatusEx OpenServiceW ChangeServiceConfigW QueryServiceConfigW ControlService DeleteService ChangeServiceConfig2W OpenSCManagerW CreateServiceW CryptExportKey CryptGetUserKey GetUserNameA CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom

shlwapi

PathFileExistsA

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

getaddrinfo inet_addr WSAPoll WSASendTo WSARecvFrom socket sendto send recvfrom recv freeaddrinfo WSAAddressToStringW WSASocketW WSASend WSARecv WSASetLastError shutdown setsockopt ntohs ntohl listen htons htonl getsockopt getsockname getpeername ioctlsocket closesocket bind WSACleanup WSAStartup gethostname gethostbyname connect accept inet_ntoa WSAGetLastError

dbghelp

MiniDumpWriteDump

kernel32

CloseHandle DeviceIoControl InitializeCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects VerSetConditionMask CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SleepEx SetWaitableTimer CreateWaitableTimerW QueueUserAPC TerminateThread TlsAlloc TlsGetValue TlsSetValue TlsFree ProcessIdToSessionId GetModuleHandleA GetProcAddress LocalFree FormatMessageA VerifyVersionInfoW WideCharToMultiByte GetCurrentProcess TerminateProcess GetExitCodeProcess OpenProcess GetTickCount64 Process32NextW Sleep DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA GetTempFileNameA MoveFileExA GetLocalTime DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx lstrcmpiW GetComputerNameA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime MoveFileA CreateToolhelp32Snapshot Process32FirstW GetCurrentProcessId LoadLibraryExA LoadResource LockResource FindResourceW SizeofResource GetSystemWow64DirectoryW GetStdHandle DuplicateHandle CreateFileA GetStartupInfoW GetConsoleWindow ReadFile WriteFile CreatePipe GetCurrentDirectoryW GetTempPathW GetSystemTimeAsFileTime FormatMessageW CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFileAttributesExW SetEndOfFile SetFilePointer SetFileTime MoveFileExW GetSystemInfo GetVersionExW ResetEvent ReleaseMutex CreateMutexW TryEnterCriticalSection MultiByteToWideChar GetCurrentThreadId SetNamedPipeHandleState WaitNamedPipeW FlushFileBuffers GetProcessId LocalAlloc CancelWaitableTimer GetModuleFileNameW GetModuleHandleW CopyFileA GetFileTime SetFilePointerEx CreateNamedPipeW DisconnectNamedPipe GetOverlappedResult ConnectNamedPipe FreeLibrary ResumeThread GetTimeZoneInformation GetFileSize OutputDebugStringA HeapCreate GetWindowsDirectoryA lstrlenA GetSystemDirectoryA GetModuleFileNameA LoadLibraryA ExpandEnvironmentStringsA GetDriveTypeA MapViewOfFile UnmapViewOfFile GetSystemWow64DirectoryA CreateFileMappingA GetACP GetTickCount QueryPerformanceCounter CreateFileMappingW GetSystemTime SystemTimeToFileTime LockFileEx UnlockFile HeapCompact LoadLibraryW WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW GetFullPathNameW AreFileApisANSI SetFileAttributesA GetThreadPriority CreateProcessA GetNativeSystemInfo SetUnhandledExceptionFilter GetFileInformationByHandle GetDriveTypeW SetConsoleCtrlHandler GetModuleHandleExW ExitThread RtlUnwindEx RtlPcToFileHeader UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation SetThreadPriority CreateThread SwitchToThread SignalObjectAndWait CreateTimerQueue IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer QueryPerformanceFrequency GetExitCodeThread GetCurrentThread GetComputerNameW GetComputerNameExW SetLastError GetLastError GetFileType PeekNamedPipe ExitProcess GetCommandLineA GetCommandLineW GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode ReadConsoleW SetStdHandle FindFirstFileExA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW GlobalMemoryStatus FlushConsoleInputBuffer ReadConsoleInputA SetConsoleMode CreateProcessW

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation wsprintfA LoadStringA GetForegroundWindow wsprintfW GetKeyNameTextA EnumDisplaySettingsA GetKeyboardLayout MapVirtualKeyA SetCursor MapVirtualKeyExA

shell32

CommandLineToArgvW SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetFolderPathA SHGetMalloc

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

VariantClear VariantInit SysAllocString SysAllocStringLen SysFreeString

mswsock

GetAcceptExSockaddrs AcceptEx

urlmon

CreateUri

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

365KB

Virtual Size

421KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=31, id=260, version=24610,

count=15, id=259, version=24610,

count=227, id=261, version=24610,

count=8, id=259, version=24123,

count=125, id=261, version=24123,

count=43, id=260, version=24123,

count=5, id=262, version=24610,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=260, version=24234,

count=68, id=265, version=24234,

count=514, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=23, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=264, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=37, id=257, version=24610,

count=567, id=1, productName=Unmarked objects,

count=140, id=261, version=24234,

count=1, id=255, version=24234,

count=1, id=151,

count=1, id=258, version=24234,