General
-
Target
8409557411.zip
-
Size
646KB
-
Sample
221117-x85keabd5z
-
MD5
f0e9fbef389f57b29566a2b124a74030
-
SHA1
530ce016c4dfbbd2ce4c9e5cf70b419cd64bc046
-
SHA256
c71fea377c4d748bfa475d91fe17ce6f53fcfdd5abd6c54641eb7a25d0827165
-
SHA512
b41e96503376a9cb5885a942e059ace8f59ad2ff55ef960aaadf1b754f052762684eb0f80aafcf41cacfb5a184d178677eb82a880f658248515da7603f75f4e3
-
SSDEEP
12288:SsGCtcjnMWnymZN75eTbpks8wH30cd2aLrO8SYFuam1ZXwChhy:VGCtnWpjeJ8wH30ifrO8ZFuLXwKhy
Static task
static1
Behavioral task
behavioral1
Sample
c39dd6590774e2d5d2f9bc94cfa6c812a4918a8e8df96337e268b516349483e2.html
Resource
win7-20220812-en
Malware Config
Extracted
qakbot
403.914
obama209
1664963577
197.94.67.207:443
197.11.134.255:443
45.227.251.167:2222
68.83.169.91:443
41.107.77.67:443
197.204.247.7:443
197.158.89.85:443
186.64.67.6:443
41.251.121.35:443
113.169.187.159:443
41.109.11.80:443
42.189.12.36:80
134.35.9.209:443
181.164.194.228:443
82.12.196.197:443
163.182.177.80:443
41.97.65.51:443
61.166.221.46:995
105.158.118.241:8443
186.86.212.138:443
181.141.3.126:443
197.207.218.27:443
139.195.43.166:2222
190.193.180.228:443
41.100.55.97:443
148.213.109.165:995
102.157.44.105:443
81.184.181.215:443
105.69.155.85:995
98.143.70.147:2222
197.207.181.147:443
196.70.77.11:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
c39dd6590774e2d5d2f9bc94cfa6c812a4918a8e8df96337e268b516349483e2
-
Size
902KB
-
MD5
995ee1df4bc961a577adc65e9bf07ecc
-
SHA1
09c76b23acf21dd34e4f3dfdbebb4c8cea68191c
-
SHA256
c39dd6590774e2d5d2f9bc94cfa6c812a4918a8e8df96337e268b516349483e2
-
SHA512
36b41ee70fee8ff38f75642eb5b8ec6ac695aa9f4196f860fd3d0206fe8fa48613764af2980ef71b02d357e49c764272dd624553dc7af392f76880cfd09173f6
-
SSDEEP
12288:wv7zjNSEZKn6FexYXe6Vra47uSvhwldvtIFQloQ0t7GbMXaP1GMZXiR:ezx4RxCzVqjl5eCMX6GM9o
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-