General
-
Target
c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
-
Size
597KB
-
Sample
221205-1qkdasag75
-
MD5
13bd4a09264d6312d957d61d64e79f53
-
SHA1
5ebf19ba1be83ad9e15991e76e509a57aaa9e9c0
-
SHA256
c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
-
SHA512
b7943be0b78a7de293b19e2b75a6b44bae34997c555e1a83a0064087d828616e601cc04cb8f13e6e44e8b9cb67fe2328b3826c8d31edf8cd5a74e9def710e582
-
SSDEEP
12288:rZzDzxF3RR3sSRogrrYW4OH5IBwBZ3TzChsL4o1U:rZzDzvvRoCBH2WBJChsMo1U
Static task
static1
Behavioral task
behavioral1
Sample
c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad.msi
Resource
win7-20220812-en
Malware Config
Extracted
qakbot
403.573
AA
1649749884
120.150.218.241:995
186.64.67.38:443
196.203.37.215:80
1.161.71.109:443
82.152.39.39:443
76.69.155.202:2222
72.66.116.235:995
103.107.113.120:443
113.11.89.165:995
208.107.221.224:443
103.88.226.30:443
75.99.168.194:443
75.113.214.234:2222
76.169.147.192:32103
190.73.3.148:2222
39.52.2.90:995
38.70.253.226:2222
5.95.58.211:2087
74.15.2.252:2222
76.70.9.169:2222
121.74.167.191:995
197.167.62.14:993
108.60.213.141:443
47.23.89.62:993
86.97.247.20:2222
47.23.89.62:995
176.67.56.94:443
86.98.33.251:443
96.37.113.36:993
148.64.96.100:443
47.180.172.159:443
140.82.49.12:443
80.11.74.81:2222
96.21.251.127:2222
177.158.7.155:443
125.168.47.127:2222
41.228.22.180:443
181.208.248.227:443
81.215.196.174:443
105.226.83.196:995
176.88.238.122:995
46.107.48.202:443
24.43.99.75:443
172.115.177.204:2222
180.129.102.214:995
2.50.137.197:443
78.87.206.213:995
72.76.94.99:443
66.98.42.102:443
109.228.220.196:443
75.99.168.194:61201
71.13.93.154:2222
45.9.20.200:443
173.174.216.62:443
31.35.28.29:443
93.48.80.198:995
32.221.224.140:995
203.122.46.130:443
47.180.172.159:50010
187.207.48.194:61202
39.44.144.159:995
92.132.172.197:2222
176.205.119.81:2078
144.202.2.175:995
45.76.167.26:995
149.28.238.199:995
45.76.167.26:443
144.202.2.175:443
144.202.3.39:995
45.63.1.12:995
140.82.63.183:995
144.202.3.39:443
149.28.238.199:443
45.63.1.12:443
140.82.63.183:443
63.143.92.99:995
70.46.220.114:443
103.87.95.133:2222
1.161.71.109:995
117.248.109.38:21
180.183.97.165:2222
86.97.11.43:443
202.134.152.2:2222
39.57.23.116:995
91.177.173.10:995
217.128.122.65:2222
24.178.196.158:2222
37.210.164.171:2222
37.186.54.254:995
86.98.208.214:2222
83.110.75.225:2222
174.69.215.101:443
217.165.147.83:993
172.114.160.81:995
84.241.8.23:32103
111.125.245.118:995
173.21.10.71:2222
182.191.92.203:995
191.99.191.28:443
73.151.236.31:443
119.158.121.244:995
71.74.12.34:443
101.50.103.193:995
47.158.25.67:443
187.172.232.250:443
47.156.191.217:443
187.250.114.15:443
187.195.19.24:443
201.145.189.252:443
72.252.201.34:990
72.252.201.34:995
45.46.53.140:2222
190.252.242.69:443
187.251.132.144:22
181.62.0.59:443
72.12.115.90:22
103.246.242.202:443
100.1.108.246:443
191.17.223.222:32101
40.134.246.185:995
24.55.67.176:443
109.12.111.14:443
90.120.65.153:2078
179.158.105.44:443
72.252.201.34:993
201.103.199.197:443
37.34.253.233:443
70.51.138.126:2222
187.102.135.142:2222
187.52.231.156:443
86.97.247.20:1194
41.84.242.5:995
186.105.121.166:443
31.48.166.122:2078
89.137.52.44:443
96.29.208.97:443
85.74.48.5:995
197.205.101.36:443
102.182.232.3:995
86.195.158.178:2222
217.164.210.192:443
197.89.8.167:443
201.211.64.196:2222
45.241.202.203:995
175.145.235.37:443
86.98.33.141:995
85.246.82.244:443
43.252.72.97:2222
67.209.195.198:990
41.38.167.179:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Targets
-
-
Target
c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
-
Size
597KB
-
MD5
13bd4a09264d6312d957d61d64e79f53
-
SHA1
5ebf19ba1be83ad9e15991e76e509a57aaa9e9c0
-
SHA256
c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
-
SHA512
b7943be0b78a7de293b19e2b75a6b44bae34997c555e1a83a0064087d828616e601cc04cb8f13e6e44e8b9cb67fe2328b3826c8d31edf8cd5a74e9def710e582
-
SSDEEP
12288:rZzDzxF3RR3sSRogrrYW4OH5IBwBZ3TzChsL4o1U:rZzDzvvRoCBH2WBJChsMo1U
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-