General
-
Target
AHK09.iso
-
Size
604KB
-
Sample
221121-vh3xsadf9w
-
MD5
8146b6b1df31b19a8652569f4eaca6c0
-
SHA1
15721ab1007e08510e206cbf4ab3c393976cce76
-
SHA256
ad5bc90515a4d5805b68206368053152b1d985f7c9cc7d7d3e5a1fea1fda3a03
-
SHA512
3b37ee1f9e9fc8e18a4829a39d5bb9998d9b92b4d2f38f2bb5ebc229083cf4b6be060eb04a8d1ff7eb5404a48dd95ae55c413485f8c3e996391574ef4929037c
-
SSDEEP
12288:NsNTXHUSlkcAPJr4WhTHiwz4agFwid7e:SNTXUSlknRhTKXF34
Static task
static1
Behavioral task
behavioral1
Sample
JG.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
JG.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
almond/slickest.dll
Resource
win7-20220812-en
Malware Config
Extracted
qakbot
404.30
BB07
1669024152
69.119.123.159:2222
197.148.17.17:2078
174.104.184.149:443
12.172.173.82:995
91.68.227.219:443
85.241.180.94:443
83.7.53.150:443
213.22.188.57:2222
71.46.234.170:443
190.75.150.58:2222
86.98.15.100:995
89.115.196.99:443
83.31.254.67:2222
46.162.109.183:443
2.84.98.228:2222
78.69.251.252:2222
12.172.173.82:465
75.143.236.149:443
47.229.96.60:443
80.121.8.212:995
74.92.243.113:50000
86.225.214.138:2222
183.82.100.110:2222
86.175.128.143:443
105.103.41.128:990
121.122.99.151:995
82.121.237.106:2222
83.248.199.56:443
81.156.198.115:2222
24.228.132.224:2222
87.243.146.59:443
174.112.25.29:2078
84.35.26.14:995
174.45.15.123:443
83.110.90.214:995
87.65.160.87:995
172.90.139.138:2222
71.247.10.63:2083
47.41.154.250:443
80.103.77.44:2222
92.11.189.236:2222
81.229.117.95:2222
91.169.12.198:32100
62.31.130.138:465
188.92.64.68:443
58.186.75.42:443
85.59.61.52:2222
94.63.65.146:443
80.13.179.151:2222
24.206.27.39:443
170.253.25.35:443
157.231.42.190:995
184.153.132.82:443
174.101.111.4:443
23.240.47.58:995
217.128.91.196:2222
62.35.67.88:443
184.155.91.69:443
86.176.144.202:2222
86.213.224.109:2222
90.104.22.28:2222
76.80.180.154:995
174.77.209.5:443
184.176.154.83:995
58.247.115.126:995
69.133.162.35:443
71.183.236.133:443
102.47.130.52:995
103.141.50.117:995
116.75.63.124:443
70.66.199.12:443
92.185.204.18:2078
130.43.107.232:995
92.24.200.226:995
81.111.108.123:443
98.145.23.67:443
197.0.235.159:443
92.137.74.174:2222
92.207.132.174:2222
12.172.173.82:50001
76.127.192.23:443
12.172.173.82:21
176.142.207.63:443
83.110.223.247:443
71.247.10.63:50003
108.6.249.139:443
24.69.87.61:443
90.89.95.158:2222
89.129.109.27:2222
91.254.215.167:443
71.247.10.63:995
47.34.30.133:443
86.130.9.140:2222
70.64.77.115:443
87.223.80.45:443
180.151.104.143:443
109.57.68.154:443
103.55.67.180:443
75.99.125.238:2222
50.68.204.71:995
73.36.196.11:443
105.184.161.242:443
187.199.224.16:32103
105.103.41.128:32103
75.156.125.215:995
170.249.59.153:443
2.91.187.6:995
87.202.101.164:50000
105.103.41.128:465
74.66.134.24:443
172.117.139.142:995
87.1.202.122:443
105.103.41.128:2078
12.172.173.82:990
86.171.75.63:443
12.172.173.82:2087
105.103.41.128:22
24.142.218.202:443
66.191.69.18:995
45.248.169.101:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
JG.js
-
Size
10KB
-
MD5
783a07cc80d63891a79ce2b586023fdb
-
SHA1
253e6383f770e5034ad912b2a3e4541b0e96818f
-
SHA256
69d42ef8cbcdb7584ae63a8c8ce927616ee2f94860abf8d8e462a8f6f9ce048c
-
SHA512
8f2ab350e53ef48c92da37e6dd514d1ed507443a8540f56d13568a7eea130ebcfe9346148d19088a243f751a2a4bdcd8ff8643d55782c29ad95aecbda0e644f4
-
SSDEEP
192:7GZSLj5Uravgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5AJ:7Gk5Kk785UIhp/KTMhSeYmn2jiu5EjPH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
almond/slickest.temp
-
Size
490KB
-
MD5
e6c54da0a5f190160aad00a01ba1f3e2
-
SHA1
62c926ba4150ca07ffe97821d1a4bd62691488b3
-
SHA256
d2adca295e33774883c6de68f2a8218043ed9ff4dfa9b9365dc1e1228a501f64
-
SHA512
729573b6750669c333e3d840e0ed1018881fe6f74674e008c490131171730d5d87095c0b364a749c20ff6dabb1ad80df176b459e4041348420c27c1a279168f0
-
SSDEEP
6144:GIZQLN2lkgFJUdgAPJgwEpPWD44TIrMUFOvctTWzpbTNEh6BgFJ+twd737Kn:GSlkcAPJr4WhTHiwz4agFwid7e
-