Static task
static1
Behavioral task
behavioral1
Sample
2024-10-09_f805cdb3272b1fa25149d443bedb3fae_magniber_qakbot.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-09_f805cdb3272b1fa25149d443bedb3fae_magniber_qakbot.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-09_f805cdb3272b1fa25149d443bedb3fae_magniber_qakbot
-
Size
1.7MB
-
MD5
f805cdb3272b1fa25149d443bedb3fae
-
SHA1
ac36f247f70fa8c677b811a9b9417b55a9bddf10
-
SHA256
5d6d7f9c765b18ae3adc7a3a2c3b857585c3cacfa17b455e5463e65d6810984b
-
SHA512
778e88f2766a4451b6a096b4ad1c86d40caa2d52c5faed1f8d4046fdddb5f838723317ea152f8590823d53a3457b2547308b1150f0c5a8f70d9f62a35c0dd36f
-
SSDEEP
24576:6WgTAHbMnTFNVk+iGEQnukBES4RqLlbp64k+oWcm4bnTrqv1Pjn:6WgebMn9TugaRwpNBsTY
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-09_f805cdb3272b1fa25149d443bedb3fae_magniber_qakbot
Files
-
2024-10-09_f805cdb3272b1fa25149d443bedb3fae_magniber_qakbot.exe windows:5 windows x86 arch:x86
7acae7052f900d5047fb6eea72cb0fcf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
CloseHandle
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetTickCount
WideCharToMultiByte
ReadFile
WriteFile
GetFileSize
lstrlenA
GetCurrentThreadId
SetLastError
CopyFileA
MoveFileA
DeleteFileA
GetFileAttributesA
GetModuleFileNameA
GetTempPathA
CreateThread
GlobalFree
GlobalAlloc
SetEndOfFile
SetFilePointer
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
MultiByteToWideChar
lstrlenW
InterlockedIncrement
InterlockedDecrement
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
FindResourceA
LoadLibraryExA
InterlockedExchangeAdd
TerminateThread
WaitForMultipleObjects
SetConsoleTextAttribute
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
WriteConsoleOutputA
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleMode
GetStdHandle
ScrollConsoleScreenBufferA
GetProcAddress
SetFileAttributesA
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
GetTimeZoneInformation
GetStringTypeW
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
FindNextFileA
GetCurrentDirectoryW
GetFullPathNameA
FlushFileBuffers
GetConsoleCP
SetHandleCount
LoadLibraryW
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
CreateFileA
GetLastError
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateFileW
GetStartupInfoW
HeapSetInformation
GetCommandLineA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetStdHandle
DuplicateHandle
RaiseException
FindFirstFileExA
GetDriveTypeA
FindClose
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ExitProcess
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedCompareExchange
InterlockedPushEntrySList
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
HeapDestroy
HeapReAlloc
HeapSize
Sleep
RtlUnwind
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
VirtualProtect
GetModuleHandleW
GetSystemInfo
VirtualQuery
WriteConsoleW
GetFileType
GetModuleFileNameW
user32
GetMonitorInfoA
MonitorFromWindow
GetWindowRect
GetWindow
DestroyWindow
GetClientRect
MapWindowPoints
SetWindowPos
GetParent
UnregisterClassA
SetWindowLongA
SetTimer
KillTimer
SendDlgItemMessageA
SetDlgItemTextA
SendMessageA
EndDialog
PeekMessageA
RegisterClassExA
CreateWindowExA
DefWindowProcA
CreateDialogParamA
CharNextA
IsDialogMessageA
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow
MessageBoxA
GetSystemMetrics
GetActiveWindow
DialogBoxParamA
SendNotifyMessageA
PostQuitMessage
LoadImageA
GetWindowLongA
advapi32
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
oleaut32
VarUI4FromStr
shlwapi
PathRemoveFileSpecA
comctl32
InitCommonControlsEx
wininet
HttpOpenRequestA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetCrackUrlA
InternetCloseHandle
InternetConnectA
InternetSetOptionA
InternetOpenA
urlmon
ObtainUserAgentString
Sections
.text Size: 548KB - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 39KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.elw Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE