Static task
static1
Behavioral task
behavioral1
Sample
2024-09-09_999106398d873865aa526f56fe3d27cf_magniber_qakbot.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-09_999106398d873865aa526f56fe3d27cf_magniber_qakbot.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-09_999106398d873865aa526f56fe3d27cf_magniber_qakbot
-
Size
1.7MB
-
MD5
999106398d873865aa526f56fe3d27cf
-
SHA1
2aa6207c404a267d5906a1f345ca2cd0c36b6438
-
SHA256
f0d06a914d0743cf40e2f41ce9fc529a7474d4d62bd4b0348fcae20ea8a92691
-
SHA512
30cb929214ab5d9b92177c681bc59ebfbb9bd505beaf5fd0fcf512be5a654fd2e41535dca21847c1632e334325db15aeef47c9cb23d17ad820897740c0fe16c4
-
SSDEEP
24576:RdNRVCr8Kj0y+G0XxGnW/yENUYT0SZXH+oWXmTKVTrX1PjXZ:R/RV+bMGWDNURSW2kTBZ
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-09_999106398d873865aa526f56fe3d27cf_magniber_qakbot
Files
-
2024-09-09_999106398d873865aa526f56fe3d27cf_magniber_qakbot.exe windows:5 windows x86 arch:x86
4f06163fbadc0099b7d9fdef81476cb8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
CloseHandle
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetTickCount
WideCharToMultiByte
WriteFile
lstrlenA
GetCurrentThreadId
SetLastError
GetTempPathA
CreateThread
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
MultiByteToWideChar
lstrlenW
InterlockedIncrement
InterlockedDecrement
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
FindResourceA
LoadLibraryExA
GetModuleFileNameA
InterlockedExchangeAdd
TerminateThread
WaitForMultipleObjects
SetConsoleTextAttribute
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
WriteConsoleOutputA
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleMode
GetStdHandle
ScrollConsoleScreenBufferA
DuplicateHandle
DeleteFileA
GetFileAttributesA
GetProcAddress
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
GetTimeZoneInformation
GetStringTypeW
ReadFile
SetEndOfFile
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
FindNextFileA
GetCurrentDirectoryW
GetFullPathNameA
FlushFileBuffers
GetConsoleCP
SetHandleCount
LoadLibraryW
HeapCreate
TlsFree
TlsSetValue
CreateFileA
GetLastError
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateFileW
SetFilePointer
SetFileAttributesA
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetStdHandle
FindFirstFileExA
GetDriveTypeA
FindClose
GetNumberOfConsoleInputEvents
PeekConsoleInputA
InterlockedCompareExchange
InterlockedPushEntrySList
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
HeapDestroy
HeapReAlloc
HeapSize
Sleep
RtlUnwind
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
VirtualProtect
GetModuleHandleW
GetSystemInfo
VirtualQuery
WriteConsoleW
GetFileType
GetModuleFileNameW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
MoveFileA
ExitProcess
user32
MapWindowPoints
GetClientRect
GetMonitorInfoA
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
UnregisterClassA
EndDialog
DestroyWindow
SetWindowLongA
SetTimer
KillTimer
SendDlgItemMessageA
SetDlgItemTextA
SendMessageA
GetWindowLongA
SetWindowPos
RegisterClassExA
CreateWindowExA
DefWindowProcA
CreateDialogParamA
CharNextA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow
GetSystemMetrics
GetActiveWindow
DialogBoxParamA
SendNotifyMessageA
PostQuitMessage
LoadImageA
IsDialogMessageA
advapi32
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
oleaut32
VarUI4FromStr
comctl32
InitCommonControlsEx
wininet
InternetSetOptionA
HttpOpenRequestA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetCrackUrlA
InternetOpenA
InternetCloseHandle
InternetConnectA
urlmon
ObtainUserAgentString
Sections
.text Size: 544KB - Virtual size: 544KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 39KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.elw Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE