urelas | 2024-10-30_fb916dbb6f8c730e862d83e408cd10a7_magniber_qakbot

Sharing

Copy URL Twitter E-mail

General

Target
2024-10-30_fb916dbb6f8c730e862d83e408cd10a7_magniber_qakbot
Size 4.7MB
Sample241030-mfpcls1fle
SHA256 ee1e34c56f3ad080b3d8cbf38b77e6ac8f9cf9a9f11b1820b5e5a9ecf0e9d85b
MD5 fb916dbb6f8c730e862d83e408cd10a7
SHA1 77b00b5b9761d2d1878a23bcb5a518b42caaa279
SHA512 3eae3e75ccda7d90056af59daa4a4583b656cdad7e3baddb785b1d3445f5d13c825f8619a18a299a6bcb233fba72a6e99f5aa410063d04ced51cf6be612c7ca9
SSDEEP 49152:v2V7djp+oE2ZjHoZB6EZ88JUUXIEABMRviTURc:v2V7NpW6Y6joU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Extracted

Family

urelas

121.88.5.183
218.54.30.235
121.88.5.181
112.223.217.101

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-30_fb916dbb6f8c730e862d83e408cd10a7_magniber_qakbot

File Explorer

2024-10-30_fb916dbb6f8c730e862d83e408cd10a7_magniber_qakbot

.exe 4.7MB

2024-10-30_fb916dbb6f8c730e862d83e408cd10a7_magniber_qakbot

IMPHASH 0ed9bb83b46883e5a2e5037acb0b0efe
SHA256 ee1e34c56f3ad080b3d8cbf38b77e6ac8f9cf9a9f11b1820b5e5a9ecf0e9d85b
MD5 fb916dbb6f8c730e862d83e408cd10a7
SHA1 77b00b5b9761d2d1878a23bcb5a518b42caaa279
SHA512 3eae3e75ccda7d90056af59daa4a4583b656cdad7e3baddb785b1d3445f5d13c825f8619a18a299a6bcb233fba72a6e99f5aa410063d04ced51cf6be612c7ca9
SSDEEP 49152:v2V7djp+oE2ZjHoZB6EZ88JUUXIEABMRviTURc:v2V7NpW6Y6joU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5122560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection GlobalFree TlsFree GetProcAddress InterlockedDecrement FreeLibrary GetCurrentProcessId lstrlenW FormatMessageW GetCurrentThreadId InterlockedIncrement lstrcmpA lstrlenA GetVersionExA GlobalUnlock LoadLibraryA LoadLibraryW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GlobalFlags FlushFileBuffers SetEndOfFile GetCurrentProcess GetModuleHandleA InitializeCriticalSection GetStartupInfoW RtlUnwind RaiseException HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime VirtualAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc SetLastError GlobalAlloc GlobalHandle WideCharToMultiByte LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime SetFilePointer GetLastError SetFileAttributesW WriteFile GetFileSizeEx FreeResource LockResource LoadResource SizeofResource FindResourceW GetModuleHandleW MultiByteToWideChar HeapFree GetProcessHeap HeapAlloc GetModuleFileNameA GetTempPathA CreateFileW ReadFile DeviceIoControl GetVersionExW CreateThread GetSystemWindowsDirectoryW GetFileAttributesW GetTickCount ExitProcess Sleep CreateEventW CloseHandle OpenEventW DeleteFileW GetSystemDirectoryW GetModuleFileNameW lstrcmpW GetTempPathW

user32

DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW ClientToScreen AdjustWindowRectEx GetDlgCtrlID CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetKeyState PeekMessageW ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId wsprintfW LoadStringW LoadAcceleratorsW SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx SetWindowTextW DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog RegisterClassW RegisterWindowMessageW PtInRect

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

gethostbyaddr htonl socket closesocket send recv gethostbyname inet_addr htons WSAStartup WSAGetLastError connect

iphlpapi

GetAdaptersAddresses

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteDC GetStockObject CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject ExtTextOutW SaveDC RestoreDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetMapMode SetViewportExtEx OffsetViewportOrgEx PtVisible SetViewportOrgEx SelectObject Escape RectVisible GetDeviceCaps TextOutW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit

Name

.text

Size

157KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

8KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

241KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

IHHYNNN

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

FRlnmaey

Size

9KB

Virtual Size

9KB

Characteristics

Name

UkDreOTi

Size

7KB

Virtual Size

7KB

Characteristics

Name

qwhdTjlk

Size

22KB

Virtual Size

22KB

Characteristics

Name

zdrvocWR

Size

543KB

Virtual Size

542KB

Characteristics

Name

ffScwCGP

Size

61KB

Virtual Size

60KB

Characteristics

Name

BfKeDpUz

Size

6KB

Virtual Size

6KB

Characteristics

Name

PwYvlkgb

Size

56KB

Virtual Size

56KB

Characteristics

Name

gxWcsUPw

Size

4KB

Virtual Size

4KB

Characteristics

Name

cLmKVGCe

Size

86KB

Virtual Size

86KB

Characteristics

Name

FplfjtMk

Size

80KB

Virtual Size

80KB

Characteristics

Name

MKFYMbFO

Size

16KB

Virtual Size

15KB

Characteristics

Name

urTwsOBw

Size

4KB

Virtual Size

3KB

Characteristics

Name

eRUuSChZ

Size

2KB

Virtual Size

1KB

Characteristics

Name

cuYAxcrr

Size

4KB

Virtual Size

3KB

Characteristics

Name

iscCJBQo

Size

253KB

Virtual Size

253KB

Characteristics

Name

bitTcrpD

Size

57KB

Virtual Size

56KB

Characteristics

Name

tTiZCcXZ

Size

1024B

Virtual Size

724B

Characteristics

Name

QglqanHi

Size

711KB

Virtual Size

710KB

Characteristics

Name

WoKMKnro

Size

73KB

Virtual Size

73KB

Characteristics

Name

NewSect

Size

40KB

Virtual Size

40KB

Characteristics

Name

WExTzuXg

Size

14KB

Virtual Size

13KB

Characteristics

Name

viiUvZgj

Size

70KB

Virtual Size

69KB

Characteristics

Name

iyCLCJvY

Size

36KB

Virtual Size

36KB

Characteristics

Name

bSTAxSZb

Size

59KB

Virtual Size

59KB

Characteristics

Name

YPXcczbQ

Size

44KB

Virtual Size

43KB

Characteristics

Name

bYqfIyJB

Size

37KB

Virtual Size

37KB

Characteristics

Name

ktXcyYdz

Size

8KB

Virtual Size

8KB

Characteristics

Name

eYirCSiw

Size

55KB

Virtual Size

54KB

Characteristics

Name

KNcIeUDs

Size

512B

Virtual Size

261B

Characteristics

Name

PmMgvIrL

Size

2KB

Virtual Size

1KB

Characteristics

Name

MaTKUcTt

Size

51KB

Virtual Size

50KB

Characteristics

Name

zbjoAuyR

Size

72KB

Virtual Size

71KB

Characteristics

Name

BxuQUTDR

Size

9KB

Virtual Size

9KB

Characteristics

Name

ajiduiQv

Size

42KB

Virtual Size

42KB

Characteristics

Name

zSqiadzC

Size

21KB

Virtual Size

21KB

Characteristics

Name

SrVINjmM

Size

10KB

Virtual Size

9KB

Characteristics

Name

ltcDiGSE

Size

35KB

Virtual Size

34KB

Characteristics

Name

gBTFXbZo

Size

71KB

Virtual Size

70KB

Characteristics

Name

kmtsPLff

Size

132KB

Virtual Size

132KB

Characteristics

Name

PNhwOkDN

Size

149KB

Virtual Size

148KB

Characteristics

Name

ucMVYWsp

Size

37KB

Virtual Size

37KB

Characteristics

Name

gHrNJHRl

Size

265KB

Virtual Size

265KB

Characteristics

Name

AmagnRUY

Size

23KB

Virtual Size

22KB

Characteristics

Name

oExzMsfU

Size

54KB

Virtual Size

54KB

Characteristics

Name

MhThpGok

Size

73KB

Virtual Size

72KB

Characteristics

Name

rJqgoQZP

Size

25KB

Virtual Size

25KB

Characteristics

Name

qWtROHAD

Size

24KB

Virtual Size

23KB

Characteristics

Name

YWuieIql

Size

59KB

Virtual Size

59KB

Characteristics

Name

rmVILVHs

Size

150KB

Virtual Size

149KB

Characteristics

Name

wrwJyqmC

Size

1024B

Virtual Size

589B

Characteristics

Name

LwjzIZpl

Size

29KB

Virtual Size

29KB

Characteristics

Name

ohDXKCQf

Size

18KB

Virtual Size

17KB

Characteristics

Name

ERIhiItp

Size

61KB

Virtual Size

60KB

Characteristics

Name

LQyEQnlk

Size

35KB

Virtual Size

34KB

Characteristics

Name

JdEmqgpW

Size

22KB

Virtual Size

21KB

Characteristics

Name

CPATdQkK

Size

6KB

Virtual Size

5KB

Characteristics

Name

nURMLSJL

Size

27KB

Virtual Size

26KB

Characteristics

Name

nLrlKjqu

Size

89KB

Virtual Size

88KB

Characteristics

Name

DvUnUVOB

Size

25KB

Virtual Size

25KB

Characteristics

Name

mXQIQXwd

Size

4KB

Virtual Size

3KB

Characteristics

Name

HPLvRkAR

Size

44KB

Virtual Size

43KB

Characteristics

Name

HrxxvWPv

Size

3KB

Virtual Size

2KB

Characteristics

Name

qrQHXAeM

Size

9KB

Virtual Size

9KB

Characteristics

Name

arLvxdcB

Size

50KB

Virtual Size

49KB

Characteristics

Name

utMWlRUm

Size

194KB

Virtual Size

194KB

Characteristics

Name

yrVgjWeE

Size

61KB

Virtual Size

60KB

Characteristics

Name

vEwtMyrj

Size

2KB

Virtual Size

1KB

Characteristics

Name

NewSec

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

NewEntr

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2024-10-30_fb916dbb6f8c730e862d83e408cd10a7_magniber_qakbot

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

oleacc

gdi32

winspool.drv

oleaut32

generic