General
-
Target
ContractCopy_YZ62.img
-
Size
1.2MB
-
Sample
221119-g7k7dagg25
-
MD5
f7ca9a8048e534b3fcb6c8f66654e63a
-
SHA1
3e7d3cd4fb07b0f3d3305afdc18e1a57b0d34a3a
-
SHA256
1821daab4216388a07240299c9d93478a49874b5c776e297e27fc4d7553229fa
-
SHA512
a36dc6b0ac552ff1742b8b69f34bc50feb4925d3de077993c246093f7ce74910198ebd92469e473ccab356ef36c40772992bed70ea336020f5ce2b30d1df6e3a
-
SSDEEP
24576:5oGd7QUoTzEWdfwTTn3M9XqdXJDi317qne:BVU4Wdf6M9XmXFi317qne
Static task
static1
Behavioral task
behavioral1
Sample
ContractCopy_YZ62.iso
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ContractCopy_YZ62.iso
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
ContractCopy.js
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
ContractCopy.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
addled/soloists.dll
Resource
win7-20220812-en
Malware Config
Extracted
qakbot
404.30
obama222
1668692319
105.184.161.242:443
73.36.196.11:443
82.31.37.241:443
24.116.45.121:443
213.67.255.57:2222
200.93.14.206:2222
188.54.79.88:995
87.220.205.14:2222
72.88.245.71:443
92.137.74.174:2222
91.68.227.219:443
184.153.132.82:443
74.66.134.24:443
47.16.73.77:2222
41.97.183.39:443
177.205.92.100:2222
24.64.114.59:3389
105.111.45.51:995
86.180.222.237:2222
76.184.95.190:993
142.119.40.220:2222
92.27.86.48:2222
180.156.240.239:995
73.230.28.7:443
176.151.15.101:443
24.64.114.59:2222
86.165.15.180:2222
66.191.69.18:995
64.121.161.102:443
50.90.249.161:443
70.115.104.126:995
99.238.106.45:443
72.140.137.221:443
174.77.209.5:443
174.104.184.149:443
2.84.98.228:2222
76.127.192.23:443
50.68.204.71:443
109.11.175.42:2222
199.83.165.233:443
85.59.61.52:2222
85.139.176.42:2222
157.231.42.190:443
85.74.158.150:2222
12.172.173.82:2087
109.152.70.207:50000
12.172.173.82:22
50.68.204.71:995
45.248.169.101:443
76.20.42.45:443
2.8.39.175:2222
81.250.33.243:2222
213.91.235.146:443
136.35.241.159:443
82.121.73.56:2222
173.239.94.212:443
184.20.10.236:443
187.199.224.16:32103
183.82.100.110:2222
102.156.113.77:443
75.99.125.238:2222
82.121.237.106:2222
79.37.204.67:443
85.241.180.94:443
217.128.91.196:2222
12.172.173.82:443
91.180.68.95:2222
98.187.21.2:443
82.9.210.36:443
181.118.183.116:443
174.45.15.123:443
2.83.62.105:443
84.113.121.103:443
77.126.81.208:443
92.106.70.62:2222
12.172.173.82:993
212.251.122.147:995
102.157.69.217:995
69.119.123.159:2222
47.176.30.75:443
87.223.80.45:443
174.60.47.98:443
173.32.181.236:443
41.228.223.122:995
82.36.36.76:443
154.247.94.160:32103
12.172.173.82:50001
12.172.173.82:995
172.90.139.138:2222
86.175.128.143:443
75.143.236.149:443
75.98.154.19:443
81.156.198.115:2222
80.121.8.212:995
103.55.67.180:443
89.152.120.181:443
83.79.150.24:2222
74.92.243.113:50000
87.220.68.51:2222
69.133.162.35:443
80.103.77.44:2222
61.92.123.169:443
74.33.84.227:443
86.225.214.138:2222
80.189.213.49:2222
188.92.64.68:443
109.145.27.139:443
121.122.99.151:995
47.185.141.97:443
81.229.117.95:2222
84.35.26.14:995
68.47.128.161:443
71.31.101.183:443
75.191.246.70:443
41.35.196.18:995
87.65.160.87:995
88.126.94.4:50000
102.158.230.141:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
ContractCopy_YZ62.img
-
Size
1.2MB
-
MD5
f7ca9a8048e534b3fcb6c8f66654e63a
-
SHA1
3e7d3cd4fb07b0f3d3305afdc18e1a57b0d34a3a
-
SHA256
1821daab4216388a07240299c9d93478a49874b5c776e297e27fc4d7553229fa
-
SHA512
a36dc6b0ac552ff1742b8b69f34bc50feb4925d3de077993c246093f7ce74910198ebd92469e473ccab356ef36c40772992bed70ea336020f5ce2b30d1df6e3a
-
SSDEEP
24576:5oGd7QUoTzEWdfwTTn3M9XqdXJDi317qne:BVU4Wdf6M9XmXFi317qne
Score3/10 -
-
-
Target
ContractCopy.js
-
Size
9KB
-
MD5
599ff2df10ec1a8497d760784e493885
-
SHA1
0b6342b8c43c76fbde2e714c2a7cda2bd1260d05
-
SHA256
fbe4408e0c0a528f331fc002f785eff7ad16f45ae3ea3ab94eb8b3cbf0c6f00f
-
SHA512
08e93e1117220b0edc589505e5d3bba99c408deb5d9ce197df864cecf838a815850d9b3a0d5c6fef9ab86396bf5af230c9b1f58f3fdbfeb7db339f97bbc15dd5
-
SSDEEP
192:GSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:BVq2k785UIro8KTMhSeYm5P2jiuuEjP4
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
addled/soloists.tmp
-
Size
781KB
-
MD5
b60b9fedc3fcf9011446349ab6430719
-
SHA1
e706be44c0bf3cf12ee1b357b0d037f172a5220a
-
SHA256
5f715c36aa0f2e60500bbc501eaacdb1e95ed38959f03a38e52009d3ec2a864f
-
SHA512
bd226954a1e8d72bafa2c5c6ac7e001b74284d1f09e785c8323bb96f4fa0b7694eb2d8105b4741438907b49c6b9e298d692652f95a31190abf7ce0a2c5fa5922
-
SSDEEP
12288:3+ed7zMD42lTz4kg3Wdf8+wawM375RGyin7ZlUP9XqcYX:Zd7QUoTzEWdfwTTn3M9XqdX
-