General
-
Target
PW40.img
-
Size
996KB
-
Sample
221117-nfxvesac7y
-
MD5
1cf5ea67cd631e725efdcbde7cc79c12
-
SHA1
81d9bb0d0c508ab392546622782647cff88fa58c
-
SHA256
95cbd6b7e4c1337620d7f0b86f9301d3b61e20f407f017d09be7dd1b3e3f2d87
-
SHA512
2344caab45d8943e22cba196f42e64641f94981c9e6220cee307de1bf4a5c7d487c6bdce8f51b4260376bccbffbabdd23341081aa7b3d1c2825ce256f5a010ce
-
SSDEEP
24576:0YSwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESx09MuI4vhL3tXC2Hk:qwvwJwRwJZwSw5wqwfHH8H2HHLwRuY0x
Static task
static1
Behavioral task
behavioral1
Sample
PW40.iso
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PW40.iso
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
SK.vbs
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
SK.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
cushioned/singes.dll
Resource
win7-20220901-en
Malware Config
Extracted
qakbot
404.30
BB06
1668610672
87.243.146.59:443
90.104.22.28:2222
200.93.14.206:2222
86.171.75.63:443
92.185.204.18:2078
86.225.214.138:2222
152.170.17.136:443
92.27.86.48:2222
76.80.180.154:995
71.31.101.183:443
91.254.215.167:443
73.22.121.210:443
87.202.101.164:50000
24.228.132.224:2222
70.121.198.103:2078
186.28.85.119:995
193.251.52.34:2222
98.211.64.94:443
172.117.139.142:995
70.51.153.72:2222
88.152.182.39:443
75.191.246.70:443
109.11.175.42:2222
76.20.42.45:443
213.67.255.57:2222
142.161.27.232:2222
212.251.122.147:995
108.6.249.139:443
90.162.45.154:2222
72.82.136.90:443
47.34.30.133:443
45.62.78.1:443
197.148.17.17:2078
89.115.196.99:443
90.4.98.190:2222
92.207.132.174:2222
86.217.250.15:2222
105.184.161.242:443
86.195.32.149:2222
73.36.196.11:443
197.26.174.95:443
105.103.50.1:2078
24.116.45.121:443
90.221.5.105:443
105.103.50.1:22
184.153.132.82:443
74.66.134.24:443
142.119.40.220:2222
188.92.64.68:443
109.145.27.139:443
24.64.114.59:3389
47.6.225.229:443
176.151.15.101:443
24.64.114.59:2222
82.34.170.37:443
66.191.69.18:995
62.31.130.138:465
80.103.77.44:2222
37.14.229.220:2222
98.30.233.14:443
177.205.92.100:2222
71.67.96.151:443
89.152.120.181:443
82.9.210.36:443
73.230.28.7:443
77.129.205.124:995
182.66.197.35:443
85.74.158.150:2222
76.127.192.23:443
50.68.204.71:443
199.83.165.233:443
85.59.61.52:2222
174.77.209.5:443
157.231.42.190:443
80.121.8.212:995
93.164.248.234:443
50.68.204.71:995
87.223.80.45:443
91.180.68.95:2222
190.24.45.24:995
190.75.110.239:443
105.105.232.103:995
72.88.245.71:443
61.92.123.169:443
197.14.218.253:443
213.91.235.146:443
47.16.73.77:2222
200.233.108.153:995
187.199.224.16:32103
98.145.23.67:443
75.99.125.238:2222
79.37.204.67:443
183.82.100.110:2222
181.118.183.116:443
77.126.81.208:443
80.189.213.49:2222
92.106.70.62:2222
82.121.73.56:2222
170.249.59.153:443
99.253.103.210:443
65.190.156.10:443
173.239.94.212:443
2.99.47.198:2222
86.165.15.180:2222
83.7.53.150:443
62.35.67.88:443
75.156.125.215:995
174.45.15.123:443
172.90.139.138:2222
75.143.236.149:443
86.176.144.225:2222
75.98.154.19:443
173.18.126.3:443
85.241.180.94:443
74.92.243.113:50000
177.46.111.176:995
105.103.50.1:32103
121.122.99.151:995
88.126.94.4:50000
174.104.184.149:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
PW40.img
-
Size
996KB
-
MD5
1cf5ea67cd631e725efdcbde7cc79c12
-
SHA1
81d9bb0d0c508ab392546622782647cff88fa58c
-
SHA256
95cbd6b7e4c1337620d7f0b86f9301d3b61e20f407f017d09be7dd1b3e3f2d87
-
SHA512
2344caab45d8943e22cba196f42e64641f94981c9e6220cee307de1bf4a5c7d487c6bdce8f51b4260376bccbffbabdd23341081aa7b3d1c2825ce256f5a010ce
-
SSDEEP
24576:0YSwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESx09MuI4vhL3tXC2Hk:qwvwJwRwJZwSw5wqwfHH8H2HHLwRuY0x
Score3/10 -
-
-
Target
SK.vbs
-
Size
9KB
-
MD5
1e3c72f980556126bb9f88bbbbab3872
-
SHA1
b953b425b8b03e03aa74050613a16dbab9556c48
-
SHA256
da5af6fcb50b21b2b5c564fe9a7d8c8bc7677823bd945e3388d1da665f7c5cd6
-
SHA512
e48552ea9dae64d0be60505a8ce49d1f6ca26845e32e9dbeaa4960b77093ae7b219f4d42ead02eaefb08c5b17faba2079203e562e88a4cd10ae703d9ba865dc0
-
SSDEEP
192:YeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:D41ajrcpE4rocCMhidGpPGmX0jWbX
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
cushioned/singes.tmp
-
Size
528KB
-
MD5
7c42dbc6c197d7b3ab4dbeec6e03915b
-
SHA1
6e7d6e5074e1df3dd81a90be9f20a0605938b991
-
SHA256
1a8842a946416dc9312226afa3ada98b9147bffe53483e0cff2bd72f49bfd249
-
SHA512
9b367cf3b5139f638a37d0afe27f36180fcfb86e12e9e462c18bc8a58bc6cc0dd8d8ec5c0b85b9a4bbc0dc93fdc5f1f89c3148f95e5d9e0c91f36a2ac93ec849
-
SSDEEP
12288:Sx4YGJ7FVsr0DUESxef9TQGWCIQ1HvhL3iL/wXLK:Sx4Yk7A4DUESx09MuI4vhL3tX
-