General
-
Target
fde448298685e05f493c89b552420f683c8b7c50a22b8a4c477f20d4c3a1c6b9
-
Size
2.2MB
-
Sample
220205-jcpx7ahccr
-
MD5
ceba7e7a9011c9b02b8ab4c4939fee05
-
SHA1
6fa528cefd9222c39fa848d0d3cf8fa1aa82a7c9
-
SHA256
fde448298685e05f493c89b552420f683c8b7c50a22b8a4c477f20d4c3a1c6b9
-
SHA512
345ab50b3cbdb75fda4eb63eff66d25336684614e0d71bbf71c0a020822a4da7f0efb682583b0475433ba928c652f428ce4a83b2b5b60abbd5a4b8ec8f8009b8
Behavioral task
behavioral1
Sample
fde448298685e05f493c89b552420f683c8b7c50a22b8a4c477f20d4c3a1c6b9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
fde448298685e05f493c89b552420f683c8b7c50a22b8a4c477f20d4c3a1c6b9.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
qakbot
324.127
spx100
1587383224
84.117.176.32:443
24.183.39.93:443
70.95.94.91:2078
79.114.194.106:443
217.162.149.212:443
66.25.168.167:2222
71.172.110.236:443
86.4.44.48:443
76.15.41.32:443
72.183.129.56:443
73.238.105.117:995
100.1.239.189:443
108.49.221.180:443
98.199.226.41:443
93.114.89.119:995
24.27.82.216:2222
85.7.22.186:2222
108.190.151.108:2222
174.30.168.163:2222
24.46.40.189:2222
208.93.202.49:443
79.118.108.197:443
86.121.171.238:993
72.28.255.159:995
74.134.35.54:443
188.209.107.195:443
46.102.8.254:443
86.124.106.166:443
73.214.231.2:443
100.40.48.96:443
65.131.79.162:995
86.124.227.238:443
73.169.47.57:443
24.37.178.158:995
89.34.231.30:443
172.95.42.35:443
120.147.67.62:2222
78.97.119.189:443
89.43.136.239:443
93.113.177.152:443
121.121.119.6:443
181.126.86.223:443
188.173.185.139:443
50.246.229.50:443
188.24.170.205:443
50.244.112.106:443
78.96.177.188:443
46.214.139.70:443
79.113.219.121:443
64.121.114.87:443
72.132.249.144:995
184.57.17.74:443
174.34.67.106:2222
71.182.142.63:443
184.21.151.81:995
76.180.69.236:443
67.251.155.12:443
95.77.144.238:443
137.99.224.198:443
67.250.184.157:443
96.35.170.82:2222
24.44.180.236:2222
50.104.67.101:443
78.96.245.58:443
47.205.231.60:443
188.241.126.118:443
24.201.79.208:2078
67.209.195.198:3389
47.146.169.85:443
47.214.144.253:443
75.87.161.32:995
108.30.161.143:443
67.131.59.17:443
47.40.244.237:443
84.117.30.222:443
188.211.67.49:443
75.110.250.89:443
188.27.17.115:443
68.134.181.98:443
89.38.74.46:443
75.81.25.223:995
173.3.132.17:995
24.229.245.124:995
67.165.206.193:995
100.38.123.22:443
72.190.124.29:443
72.16.212.107:465
108.54.103.234:443
24.115.246.224:995
79.119.69.76:443
75.82.228.209:443
94.52.160.116:443
86.123.130.104:443
70.174.3.241:443
5.182.39.156:443
24.37.178.158:443
47.136.224.60:443
108.227.161.27:995
188.26.142.13:443
72.29.181.77:2078
107.2.148.99:443
66.208.105.6:443
80.14.209.42:2222
24.55.152.50:995
78.97.3.6:443
47.180.66.10:443
72.214.55.147:995
69.92.54.95:995
76.187.97.98:2222
79.118.77.91:443
184.180.157.203:2222
97.127.144.203:2222
5.12.254.4:443
72.29.181.77:2222
79.115.196.34:443
84.247.55.190:443
50.108.212.180:443
70.126.76.75:443
190.204.35.66:2078
76.187.8.160:443
93.118.208.118:443
188.25.237.208:443
50.78.93.74:443
173.175.29.210:443
188.24.25.202:443
50.29.166.232:995
85.121.42.12:443
72.190.30.180:443
89.45.110.60:443
72.142.106.198:995
104.36.135.227:443
72.78.198.100:443
62.121.123.57:443
95.77.237.115:443
81.103.144.77:443
46.214.139.214:443
184.98.104.7:995
24.243.142.134:443
66.26.160.37:443
86.120.5.65:443
73.37.1.116:443
68.46.142.48:995
70.124.29.226:443
80.11.10.151:990
76.170.77.99:443
23.24.115.181:443
86.125.208.132:443
70.62.160.186:6883
98.219.77.197:443
73.226.220.56:443
Targets
-
-
Target
fde448298685e05f493c89b552420f683c8b7c50a22b8a4c477f20d4c3a1c6b9
-
Size
2.2MB
-
MD5
ceba7e7a9011c9b02b8ab4c4939fee05
-
SHA1
6fa528cefd9222c39fa848d0d3cf8fa1aa82a7c9
-
SHA256
fde448298685e05f493c89b552420f683c8b7c50a22b8a4c477f20d4c3a1c6b9
-
SHA512
345ab50b3cbdb75fda4eb63eff66d25336684614e0d71bbf71c0a020822a4da7f0efb682583b0475433ba928c652f428ce4a83b2b5b60abbd5a4b8ec8f8009b8
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-