General
-
Target
aatnj.exe
-
Size
39MB
-
Sample
201228-v895ds2qm2
-
MD5
2cf766692a75309734b08b3bd8cc36df
-
SHA1
a003224582db124237e8c879d795aefe8d23b22b
-
SHA256
1ee6f8e9bbc53afa81c39326d5748c6c4322d2501c42adcb34f5b71bc34ae48b
-
SHA512
a28bf5af4c30152bd89d23e5295e9a6faa23eac6f312d7841bfb4664fe725bf42fed2fe4bb65c164709d6aa98a5ff66cbb78ed86396be975d2aeb1386afcda2c
Static task
static1
Behavioral task
behavioral1
Sample
aatnj.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
aatnj.exe
Resource
win10v20201028
Malware Config
Extracted
https://www.allens-treasure-house.com/books_files/001.ps1
Extracted
qakbot
1513068643
Protocol: ftp- Host:
66.96.133.9 - Port:
21 - Username:
help - Password:
eT5TerAcnFe6~
Protocol: ftp- Host:
174.123.38.58 - Port:
21 - Username:
log@thebrainregistry.com - Password:
4BQ1MeeRAwNZEVu
Protocol: ftp- Host:
61.221.12.26 - Port:
21 - Username:
logger@ostergift.com - Password:
346HZGCMlwecz9S
Protocol: ftp- Host:
67.222.137.18 - Port:
21 - Username:
logger@grupocrepusculo.net - Password:
p4a8k6fE1FtA3pR
Protocol: ftp- Host:
107.6.152.61 - Port:
21 - Username:
logger@trussedup.com - Password:
RoP4Af0RKAAQ74V
1.1.192.123:443
160.3.251.154:995
75.127.141.50:995
108.49.159.2:990
96.70.92.177:1194
70.184.255.4:443
73.171.50.80:443
98.201.98.191:443
104.159.220.171:443
100.8.244.14:443
66.76.136.65:443
24.45.150.163:443
216.201.159.118:443
66.76.136.65:1194
160.3.251.154:443
27.3.93.3:443
58.108.210.165:995
96.70.92.177:993
108.58.44.6:443
117.195.243.76:443
105.229.108.111:443
209.212.131.66:443
75.83.30.135:443
68.173.55.51:443
70.118.18.242:443
108.35.199.8:443
75.143.231.200:443
173.72.96.50:995
73.76.201.210:443
173.72.96.50:443
174.57.88.157:443
76.4.219.37:995
66.222.48.40:443
24.45.189.76:995
98.163.53.175:993
86.27.41.234:443
71.190.202.120:443
108.49.159.2:995
71.85.72.9:443
189.170.52.201:443
50.192.121.62:6881
47.223.78.244:993
98.163.220.232:443
98.191.105.101:995
216.251.203.253:443
108.49.159.2:993
192.158.217.32:21
132.206.59.132:443
192.158.217.32:443
73.183.141.219:443
151.202.46.113:443
47.143.83.172:443
198.57.88.73:443
66.189.228.49:995
98.20.35.129:443
71.207.137.218:443
132.251.250.58:443
71.194.162.118:443
108.214.190.141:22
68.228.32.197:2222
174.79.244.142:2222
73.171.208.223:443
73.255.36.173:443
47.22.21.180:995
73.251.254.127:443
24.194.177.157:995
73.198.142.130:995
76.188.197.130:443
75.167.243.66:443
100.36.37.26:995
104.137.5.218:443
173.49.95.92:443
136.61.161.102:443
98.191.105.101:993
107.184.242.19:443
73.250.49.41:443
174.81.187.84:443
73.84.126.181:443
65.218.249.250:443
24.14.39.10:443
100.1.178.79:6882
78.168.137.109:443
108.58.129.90:443
76.95.241.114:443
41.200.147.155:443
75.97.144.106:995
95.15.254.82:443
67.247.220.195:443
98.102.37.174:2222
72.250.217.132:443
41.249.172.38:443
70.184.181.88:443
71.84.92.193:995
73.77.96.186:443
108.35.21.79:443
108.58.129.90:995
151.202.46.113:995
82.34.193.149:443
88.252.146.139:995
68.83.130.163:443
73.235.172.45:443
24.45.230.32:443
24.77.124.178:443
184.155.19.94:2222
173.247.186.90:6882
78.164.51.158:443
125.25.133.71:995
72.251.9.200:443
38.93.152.30:443
172.87.188.2:443
73.171.208.63:443
5.220.175.152:2222
98.121.199.219:443
50.198.141.161:2222
174.16.153.98:995
173.28.239.79:443
184.186.73.221:443
170.185.153.17:2222
118.71.69.27:443
70.57.113.151:443
170.185.126.17:443
216.51.79.71:443
75.64.168.85:443
216.228.55.13:443
73.8.165.2:443
209.239.101.72:443
168.10.142.2:443
170.215.211.14:443
72.20.132.2:443
70.189.67.15:443
71.232.248.52:443
68.199.118.150:2222
165.138.13.253:995
100.35.50.18:2222
208.49.151.160:443
69.245.219.31:443
50.206.74.2:443
76.183.233.1:443
47.201.100.228:443
108.45.105.144:443
142.112.229.81:2222
65.35.242.188:443
69.157.60.221:2222
173.48.159.185:443
47.208.196.196:443
107.77.224.127:443
156.198.69.177:443
24.45.189.76:443
Extracted
https://www.allens-treasure-house.com/books_files/001.ps1
Targets
-
-
Target
aatnj.exe
-
Size
39MB
-
MD5
2cf766692a75309734b08b3bd8cc36df
-
SHA1
a003224582db124237e8c879d795aefe8d23b22b
-
SHA256
1ee6f8e9bbc53afa81c39326d5748c6c4322d2501c42adcb34f5b71bc34ae48b
-
SHA512
a28bf5af4c30152bd89d23e5295e9a6faa23eac6f312d7841bfb4664fe725bf42fed2fe4bb65c164709d6aa98a5ff66cbb78ed86396be975d2aeb1386afcda2c
Score10/10-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-