General
-
Target
DHZ51.iso
-
Size
604KB
-
Sample
221121-scte2saa8z
-
MD5
ae529f6eb6665382bbcdc45e38aef54f
-
SHA1
914db4ba9ddde379a2386d481004d0a80370e488
-
SHA256
152932e1869f55ed3063006cce0bf0203a738778ddde785751019f220b1bad38
-
SHA512
cdabda811f4b9a0746fe8fd56b402b19dbd5696d5582d66e76c1aa2c9412f3028990c29de9cec8a1ea98cfbb441f9e2bfba55470f3671f152d387d60dd4b4041
-
SSDEEP
12288:3CNfXHUSlkcAPJr4WhTriwz4agFwid7e:yNfXUSlknRhT2XF34
Static task
static1
Behavioral task
behavioral1
Sample
JG.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
JG.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
almond/representable.dll
Resource
win7-20221111-en
Malware Config
Extracted
qakbot
404.30
BB07
1669024152
69.119.123.159:2222
197.148.17.17:2078
174.104.184.149:443
12.172.173.82:995
91.68.227.219:443
85.241.180.94:443
83.7.53.150:443
213.22.188.57:2222
71.46.234.170:443
190.75.150.58:2222
86.98.15.100:995
89.115.196.99:443
83.31.254.67:2222
46.162.109.183:443
2.84.98.228:2222
78.69.251.252:2222
12.172.173.82:465
75.143.236.149:443
47.229.96.60:443
80.121.8.212:995
74.92.243.113:50000
86.225.214.138:2222
183.82.100.110:2222
86.175.128.143:443
105.103.41.128:990
121.122.99.151:995
82.121.237.106:2222
83.248.199.56:443
81.156.198.115:2222
24.228.132.224:2222
87.243.146.59:443
174.112.25.29:2078
84.35.26.14:995
174.45.15.123:443
83.110.90.214:995
87.65.160.87:995
172.90.139.138:2222
71.247.10.63:2083
47.41.154.250:443
80.103.77.44:2222
92.11.189.236:2222
81.229.117.95:2222
91.169.12.198:32100
62.31.130.138:465
188.92.64.68:443
58.186.75.42:443
85.59.61.52:2222
94.63.65.146:443
80.13.179.151:2222
24.206.27.39:443
170.253.25.35:443
157.231.42.190:995
184.153.132.82:443
174.101.111.4:443
23.240.47.58:995
217.128.91.196:2222
62.35.67.88:443
184.155.91.69:443
86.176.144.202:2222
86.213.224.109:2222
90.104.22.28:2222
76.80.180.154:995
174.77.209.5:443
184.176.154.83:995
58.247.115.126:995
69.133.162.35:443
71.183.236.133:443
102.47.130.52:995
103.141.50.117:995
116.75.63.124:443
70.66.199.12:443
92.185.204.18:2078
130.43.107.232:995
92.24.200.226:995
81.111.108.123:443
98.145.23.67:443
197.0.235.159:443
92.137.74.174:2222
92.207.132.174:2222
12.172.173.82:50001
76.127.192.23:443
12.172.173.82:21
176.142.207.63:443
83.110.223.247:443
71.247.10.63:50003
108.6.249.139:443
24.69.87.61:443
90.89.95.158:2222
89.129.109.27:2222
91.254.215.167:443
71.247.10.63:995
47.34.30.133:443
86.130.9.140:2222
70.64.77.115:443
87.223.80.45:443
180.151.104.143:443
109.57.68.154:443
103.55.67.180:443
75.99.125.238:2222
50.68.204.71:995
73.36.196.11:443
105.184.161.242:443
187.199.224.16:32103
105.103.41.128:32103
75.156.125.215:995
170.249.59.153:443
2.91.187.6:995
87.202.101.164:50000
105.103.41.128:465
74.66.134.24:443
172.117.139.142:995
87.1.202.122:443
105.103.41.128:2078
12.172.173.82:990
86.171.75.63:443
12.172.173.82:2087
105.103.41.128:22
24.142.218.202:443
66.191.69.18:995
45.248.169.101:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Extracted
qakbot
-
salt
~�w%��N$���0��U��J��m�/+
Targets
-
-
Target
JG.js
-
Size
10KB
-
MD5
b85a2b30e88913e43322666da31b573c
-
SHA1
37c835ff4db8813e2f33fe38311bdc1aa39bfc6c
-
SHA256
7dc7656db7d5edb9fb34a11278853a846bd89f29615b2bae5c7bf6d9d3200282
-
SHA512
50140c18594d396f11ae2373d044b102a98fbca465f09acd4a743f9dc6a2d3be899932f42f4c292ff7275cd5f45c90da505a9342fc0f8365b63610269fc954bd
-
SSDEEP
192:7GfSLj5Uravgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5AJ:7G25Kk785UIhp/KTMhSeYmn2jiu5EjPH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
almond/representable.temp
-
Size
490KB
-
MD5
c60f6f286c5eaea3d5a5430723a141f5
-
SHA1
dd0f6aa4aa495808049f90457363aee85ff671c6
-
SHA256
d9059ecf1b028af98406785452180bbfeaef32357d47f72d36168e95008f877e
-
SHA512
aa9d40779c21c85ef95d7e6d474f99e8dbe25c5b5c64227ea398e2dc45d7ecc5ddb2f70959eb5a79e0d6190215b5e73096dcdc38e59079e2c9c2d859aefc1b5a
-
SSDEEP
6144:GIZQLN2lkgFJUdgAPJgwEpPWD44TIbMUFOvctTWzpbTNEh6BgFJ+twd737Kn:GSlkcAPJr4WhTriwz4agFwid7e
-