Overview

overview

10

Static

static

10

d4492c61ee...18.dll

windows7-x64

10

d4492c61ee...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4492c61ee559588e83fe74feef61b5c_JaffaCakes118

  • Size

    184KB

  • MD5

    d4492c61ee559588e83fe74feef61b5c

  • SHA1

    d1adf94903992c909633032bc07552d716b39240

  • SHA256

    1579d32ee1dc31bab47e515f9849c4a82fb08ae76ea698ff9832736fe3020f75

  • SHA512

    ffabb0c92cc52500f0d5f51d0f5394528adbfb095ecf85528e5dbaf00d97825b709305e33b3a77ba3916bf68887c64f2ef6d31d43eb95d5a1285d562b09dd89a

  • SSDEEP

    3072:agp4bgYkM32chYZgTtJ4a/gEITBfAfdgwfztOo4T+fgno8muPwWe:agpvM32chMg5JF//ITBY1gOB1fmmuPwT

Score
10/10
tr1632152742qakbot

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

tr

Campaign

1632152742

C2

45.46.53.140:2222

144.139.47.206:443

189.210.115.207:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

24.139.72.117:443

24.229.150.54:995

24.55.112.61:443

136.232.34.70:443

95.77.223.148:443

173.21.10.71:2222

76.25.142.196:443

96.37.113.36:993

71.74.12.34:443

73.151.236.31:443

67.165.206.193:993

109.12.111.14:443

68.204.7.158:443

105.198.236.99:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot family
    qakbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • d4492c61ee559588e83fe74feef61b5c_JaffaCakes118
    .dll regsvr32 windows:6 windows x86 arch:x86

    4ffea09c47d1299922aabf21a554a45d


    Headers

    Imports

    Exports

    Sections