General
-
Target
Art#4376.zip
-
Size
605KB
-
Sample
220926-ynv1xabhd5
-
MD5
6a793a5e8c1ab979df01b4dccde9ca32
-
SHA1
17deb587031196f62b8d3a53c60541fd0959457d
-
SHA256
2827772c694257f02892bfc37635cb4f7e873e598bdca9a3e43bc5dd92709543
-
SHA512
9fe9b6a57667a2c414b32efd91e764e2ce001fb851b44bb467bd113f0a1e518f448e94d1d3fa7ad10db247cf1d065d4efabed8964bab7631a4223b3afd0fb989
-
SSDEEP
12288:R5WRiTvdfmH2KzulB3vzZDGUIex97hr7fcrPdmgTL5qnQWW3BEKzqzccp/8H:R5L1T3vzZaCPJErPk0wn1wEIqzU
Static task
static1
Malware Config
Extracted
qakbot
403.895
BB
1664184863
197.204.227.155:443
123.23.64.230:443
173.218.180.91:443
111.125.157.230:443
70.49.33.200:2222
149.28.38.16:995
86.132.13.105:2078
149.28.38.16:443
45.77.159.252:995
45.77.159.252:443
149.28.63.197:995
144.202.15.58:443
45.63.10.144:443
45.63.10.144:995
149.28.63.197:443
144.202.15.58:995
39.121.226.109:443
177.255.14.99:995
134.35.10.30:443
99.232.140.205:2222
180.180.132.100:443
86.176.180.223:993
41.98.11.74:443
196.64.230.149:8443
68.224.229.42:443
41.111.72.234:995
196.64.237.130:443
190.44.40.48:995
70.51.132.197:2222
88.232.207.24:443
115.247.12.66:443
189.19.189.222:32101
72.88.245.71:443
217.165.97.141:993
191.97.234.238:995
119.82.111.158:443
88.237.6.72:53
100.1.5.250:995
96.234.66.76:995
186.64.67.34:443
66.181.164.43:443
193.3.19.37:443
197.94.84.128:443
41.96.130.46:80
187.205.222.100:443
139.228.33.176:2222
88.245.168.200:2222
110.4.255.247:443
89.211.217.38:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
Art#4376.zip
-
Size
605KB
-
MD5
6a793a5e8c1ab979df01b4dccde9ca32
-
SHA1
17deb587031196f62b8d3a53c60541fd0959457d
-
SHA256
2827772c694257f02892bfc37635cb4f7e873e598bdca9a3e43bc5dd92709543
-
SHA512
9fe9b6a57667a2c414b32efd91e764e2ce001fb851b44bb467bd113f0a1e518f448e94d1d3fa7ad10db247cf1d065d4efabed8964bab7631a4223b3afd0fb989
-
SSDEEP
12288:R5WRiTvdfmH2KzulB3vzZDGUIex97hr7fcrPdmgTL5qnQWW3BEKzqzccp/8H:R5L1T3vzZaCPJErPk0wn1wEIqzU
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-