General
-
Target
VO-756.iso
-
Size
690KB
-
Sample
221129-gxbj7ace79
-
MD5
5453066177c8a8352243e6575266d536
-
SHA1
a0102f7a7eb988c395307cbaf8188541704fd514
-
SHA256
0e95ff90f54057a32849e615dd615d947c6932383d01f9efc01c4e106d64a863
-
SHA512
540f9361b3441cc4e7fb0589fa86b760df5daba54aa285e73e4aeca6042e61e069a92a244b92d8945a6e972e492be1b21baca35b3daff5099c12455457737538
-
SSDEEP
12288:Jhm1Mcw5EO6dHvDe0P3lx5EBto8BkfzNbuTyGrC6N2c2mcsAMzRGBRA4cZD:J6MFEO6dHvDe0P335EXpUNSleQ2cYCGg
Static task
static1
Behavioral task
behavioral1
Sample
AS.js
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
AS.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
fix/plaintiveness.js
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
fix/plaintiveness.js
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
fix/worlds.ps1
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
fix/worlds.ps1
Resource
win10v2004-20220901-en
Malware Config
Extracted
qakbot
404.46
BB08
1669628564
98.147.155.235:443
85.52.73.34:2222
75.158.15.211:443
2.91.184.252:995
92.106.70.62:2222
85.152.152.46:443
86.159.48.25:2222
217.128.91.196:2222
92.11.189.236:2222
83.92.85.93:443
2.83.62.105:443
93.24.192.142:20
76.20.42.45:443
24.64.114.59:2078
73.36.196.11:443
130.43.99.103:995
172.117.139.142:995
100.16.107.117:443
12.172.173.82:22
176.151.15.101:443
50.68.204.71:443
58.162.223.233:443
50.68.204.71:993
108.162.6.34:995
24.142.218.202:443
174.112.25.29:2078
190.207.253.41:2222
66.191.69.18:995
85.241.180.94:443
149.126.159.106:443
75.141.227.169:443
31.167.227.31:443
173.18.126.3:443
184.153.132.82:443
176.142.207.63:443
82.9.210.36:443
87.221.197.110:2222
174.104.184.149:443
98.145.23.67:443
12.172.173.82:993
24.64.114.59:2222
116.75.63.225:443
136.232.184.134:995
77.126.81.208:443
62.31.130.138:465
75.99.125.235:2222
173.239.94.212:443
92.186.69.229:2222
92.24.200.226:995
109.218.104.206:2222
87.223.85.4:443
24.206.27.39:443
69.119.123.159:2222
64.121.161.102:443
91.169.12.198:32100
58.247.115.126:995
187.199.224.16:32103
123.3.240.16:995
122.178.197.139:995
102.156.232.220:443
12.172.173.82:995
92.98.228.28:2222
86.98.182.30:2222
90.116.219.167:2222
92.27.86.48:2222
93.156.103.241:443
85.7.61.22:2222
105.109.140.201:32103
86.225.214.138:2222
76.100.159.250:443
93.147.235.8:443
75.143.236.149:443
94.63.65.146:443
74.92.243.113:50000
75.98.154.19:443
216.196.245.102:2222
83.110.223.247:443
121.122.99.223:995
70.120.228.205:2083
47.229.96.60:443
86.171.75.63:443
89.129.109.27:2222
136.244.25.165:443
92.137.74.174:2222
78.69.251.252:2222
175.205.2.54:443
12.172.173.82:465
92.185.204.18:2078
58.186.75.42:443
76.80.180.154:995
84.35.26.14:995
190.18.236.175:443
47.41.154.250:443
190.11.198.66:443
81.229.117.95:2222
190.39.199.51:443
197.3.64.204:995
213.67.255.57:2222
86.195.32.149:2222
70.115.104.126:995
24.64.114.59:3389
216.196.245.102:2083
108.162.6.34:443
50.90.249.161:443
170.253.25.35:443
103.144.201.62:2078
24.64.114.59:50010
23.240.47.58:995
45.248.169.101:443
92.239.81.124:443
83.21.138.251:2222
80.13.179.151:2222
184.155.91.69:443
193.154.207.221:443
90.104.22.28:2222
71.247.10.63:50003
108.6.249.139:443
184.176.154.83:995
174.77.209.5:443
100.8.168.108:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
AS.js
-
Size
131B
-
MD5
2b0f9e1ca1aee199de0cc4f2159b8832
-
SHA1
7862ef406f7c6e9a8e8d9a2a7482b85780a6a25b
-
SHA256
68498e9ff091f30e623fffab48c4f1d09f968a59c497b143895d02f300f7e8c0
-
SHA512
485bf7e2ddcf5e5058b58c50d91d52c7080a118423d54819550f4b2f95bce6a3c5ab3c516bc2ff1df8eaa2fde8fb676ce794cd5e0e75a67bc67d83871aa52ad2
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
-
-
Target
fix/plaintiveness.js
-
Size
131B
-
MD5
2b0f9e1ca1aee199de0cc4f2159b8832
-
SHA1
7862ef406f7c6e9a8e8d9a2a7482b85780a6a25b
-
SHA256
68498e9ff091f30e623fffab48c4f1d09f968a59c497b143895d02f300f7e8c0
-
SHA512
485bf7e2ddcf5e5058b58c50d91d52c7080a118423d54819550f4b2f95bce6a3c5ab3c516bc2ff1df8eaa2fde8fb676ce794cd5e0e75a67bc67d83871aa52ad2
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
fix/worlds.ps1
-
Size
377B
-
MD5
eff4099ef965ff990feadfc07ec4fa45
-
SHA1
33f65bbdec8933c18ff9adb670edf41bd6d99814
-
SHA256
5a9a33cf23a1e306e0956cc7e0706a0a6deb778f44105473018ee791e315ee64
-
SHA512
7290331c16185eb95a22c0a7eaa8746046a82302f40c418ce245687e7335469cb978eafb1a9c85324c50981555d8be56ac9c50eab9455f837f3bd98c0fff3f52
Score1/10 -