General
-
Target
a69fdd9e4c3558d323c3ddab6c89328ead207046764019014e013dc696d5861e
-
Size
2.3MB
-
Sample
220205-ny42fsbac3
-
MD5
ab979bad22978286f693fa6d89733b59
-
SHA1
f65c54320e98a65c850ee1cbd29ff26f1b6f0f43
-
SHA256
a69fdd9e4c3558d323c3ddab6c89328ead207046764019014e013dc696d5861e
-
SHA512
8e480e83a920ef62fdfc93cea622c93ee4ca1134e6ddfcfccf08b126fcdbe1dcb36ec5863e7126d0d5babafd9ffa08b2abcf5afbb2753e0ad7be7d8d9a7003d8
Behavioral task
behavioral1
Sample
a69fdd9e4c3558d323c3ddab6c89328ead207046764019014e013dc696d5861e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a69fdd9e4c3558d323c3ddab6c89328ead207046764019014e013dc696d5861e.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
qakbot
324.127
spx101
1587470509
98.213.28.175:443
89.38.74.46:443
75.81.25.223:995
72.16.57.99:443
173.3.132.17:995
24.229.245.124:995
67.165.206.193:995
66.25.168.167:2222
68.39.177.147:995
100.38.123.22:443
66.44.96.184:443
75.110.93.212:443
110.142.205.182:443
72.16.212.107:465
67.251.155.12:443
100.40.48.96:443
24.55.152.50:995
65.131.79.162:995
181.126.86.223:443
73.169.47.57:443
85.154.102.243:443
168.103.52.51:995
108.54.103.234:443
24.115.246.224:995
184.21.151.81:995
68.58.141.12:443
75.82.228.209:443
84.232.238.30:443
68.98.142.248:443
172.95.42.35:443
58.177.238.186:443
71.182.142.63:443
24.27.82.216:2222
65.60.228.130:443
216.16.178.115:443
120.147.67.62:2222
92.97.116.28:443
24.228.7.174:443
76.180.69.236:443
184.167.2.251:2222
209.182.121.133:2222
98.121.187.78:443
5.182.39.156:443
76.179.54.116:443
47.136.224.60:443
108.227.161.27:995
72.204.242.138:53
72.204.242.138:50003
31.215.246.130:2078
217.162.149.212:443
79.114.194.106:443
203.33.139.134:443
95.77.144.238:443
195.162.106.93:2222
186.94.191.6:2078
121.121.119.6:443
86.126.195.187:443
73.214.231.2:443
110.143.188.155:32101
108.190.151.108:2222
72.132.249.144:995
64.121.114.87:443
78.96.245.58:443
98.199.226.41:443
208.93.202.49:443
72.190.30.180:443
76.25.142.196:443
71.178.38.101:443
72.78.198.100:443
184.180.157.203:2222
148.75.231.53:443
79.115.211.4:2222
97.127.144.203:2222
72.29.181.77:2222
50.246.229.50:443
50.244.112.106:443
79.113.219.121:443
188.27.17.115:443
81.133.234.36:2222
76.187.8.160:443
81.103.144.77:443
70.126.76.75:443
176.223.114.129:443
70.174.3.241:443
86.4.44.48:443
93.114.89.119:995
72.183.129.56:443
98.22.66.236:443
86.123.130.104:443
50.78.93.74:443
186.49.245.64:995
86.126.126.75:443
79.119.69.76:443
35.142.126.181:443
184.57.17.74:443
108.49.221.180:443
66.208.105.6:443
76.15.41.32:443
70.57.15.187:993
72.36.59.46:2222
104.36.135.227:443
24.210.45.215:443
173.173.68.41:443
96.57.42.130:443
80.11.10.151:990
84.117.89.128:443
73.226.220.56:443
76.170.77.99:443
24.32.119.146:443
23.24.115.181:443
68.49.120.179:443
70.62.160.186:6883
98.219.77.197:443
49.191.9.180:995
74.33.70.30:443
65.116.179.83:443
47.153.115.154:443
71.77.252.14:2222
24.202.42.48:2222
94.52.160.218:443
108.27.217.44:443
86.127.12.161:21
70.183.127.6:995
172.78.87.180:443
201.152.177.86:995
64.19.74.29:995
73.37.1.116:443
75.137.60.81:443
68.225.250.136:443
173.70.165.101:995
68.174.15.223:443
208.126.142.17:443
72.209.191.27:443
86.127.1.144:443
104.235.116.15:443
172.242.246.83:443
46.102.79.40:443
94.53.113.215:443
212.126.109.14:443
50.108.212.180:443
137.99.224.198:443
31.5.205.122:443
67.250.184.157:443
96.35.170.82:2222
24.44.180.236:2222
79.113.108.143:443
50.104.67.101:443
173.172.205.216:443
85.204.189.105:443
79.115.121.46:443
Targets
-
-
Target
a69fdd9e4c3558d323c3ddab6c89328ead207046764019014e013dc696d5861e
-
Size
2.3MB
-
MD5
ab979bad22978286f693fa6d89733b59
-
SHA1
f65c54320e98a65c850ee1cbd29ff26f1b6f0f43
-
SHA256
a69fdd9e4c3558d323c3ddab6c89328ead207046764019014e013dc696d5861e
-
SHA512
8e480e83a920ef62fdfc93cea622c93ee4ca1134e6ddfcfccf08b126fcdbe1dcb36ec5863e7126d0d5babafd9ffa08b2abcf5afbb2753e0ad7be7d8d9a7003d8
-
Turns off Windows Defender SpyNet reporting
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-