General
-
Target
LN12.zip
-
Size
349KB
-
Sample
221206-qtjaascc34
-
MD5
75e5c2e7e3a6091cada07d9eba405b0e
-
SHA1
492a1b86169a88041df70f0e930be1478c6dd278
-
SHA256
2c9a1589ddb6fb301b4900816e51faf0cde4d90148e1c233d25862be62bb2dd8
-
SHA512
3a41db9497e90c9a4f575ea32c3cf687367f94481acf68f73decac2e84fa0d410a0a1fd457342246ac5027c939f32c286d539a44bf1fcaf6bf0abffc79958f88
-
SSDEEP
6144:Fe5ls62fggxdvbJ1jTCmZzabGAjyyejdndKcjBgiMdpUXZp5kBxEhvyhx3tkIef:Fe5yRvbD/zUZReBnUdKwNx37o
Static task
static1
Behavioral task
behavioral1
Sample
DS.lnk
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
DS.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
sandalwood/annotates.cmd
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
sandalwood/annotates.cmd
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
sandalwood/forthcoming.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
sandalwood/forthcoming.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
sandalwood/mynah.cmd
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
sandalwood/mynah.cmd
Resource
win10v2004-20220901-en
Malware Config
Extracted
qakbot
404.46
BB09
1670354428
216.82.134.218:443
49.175.72.56:443
12.172.173.82:22
12.172.173.82:50001
190.24.45.24:995
103.144.201.62:2078
24.142.218.202:443
70.160.80.210:443
24.228.132.224:2222
117.186.222.30:993
173.18.126.3:443
75.99.125.235:2222
172.90.139.138:2222
136.232.184.134:995
123.3.240.16:995
76.100.159.250:443
66.191.69.18:995
181.118.183.44:443
31.167.254.199:995
183.82.100.110:2222
83.92.85.93:443
91.169.12.198:32100
24.64.114.59:2222
74.66.134.24:443
78.69.251.252:2222
91.68.227.219:443
12.172.173.82:993
24.177.111.153:443
85.7.61.22:2222
70.181.149.227:443
173.239.94.212:443
92.24.200.226:995
104.152.223.133:443
80.13.179.151:2222
69.119.123.159:2222
70.95.236.129:443
64.121.161.102:443
70.115.104.126:995
12.172.173.82:995
221.161.103.6:443
66.131.25.6:443
200.109.14.93:2222
213.91.235.146:443
76.80.180.154:995
2.83.12.243:443
81.248.77.37:2222
12.172.173.82:465
70.64.77.115:443
75.143.236.149:443
81.229.117.95:2222
75.98.154.19:443
121.122.99.223:995
47.34.30.133:443
92.189.214.236:2222
216.196.245.102:2083
136.244.25.165:443
188.48.123.229:995
90.104.22.28:2222
204.210.210.7:443
78.92.133.215:443
47.41.154.250:443
50.68.204.71:995
65.30.139.145:995
71.247.10.63:995
58.162.223.233:443
50.68.204.71:443
73.161.176.218:443
58.247.115.126:995
199.83.165.233:443
98.145.23.67:443
84.35.26.14:995
24.64.114.59:3389
149.126.159.106:443
116.74.164.2:443
24.206.27.39:443
12.172.173.82:21
77.86.98.236:443
50.68.204.71:993
190.206.70.80:2222
41.44.19.36:995
137.186.193.226:3389
139.216.164.122:443
184.176.154.83:995
92.207.132.174:2222
142.161.27.232:2222
73.155.10.79:443
176.142.207.63:443
103.55.67.180:443
184.153.132.82:443
76.20.42.45:443
174.104.184.149:443
108.6.249.139:443
69.133.162.35:443
198.2.51.242:993
184.101.163.128:443
70.77.116.233:443
24.64.114.59:61202
66.176.250.180:443
75.158.15.211:443
181.164.194.228:443
72.200.109.104:443
174.101.111.4:443
86.225.214.138:2222
86.98.23.199:443
84.113.121.103:443
86.96.75.237:2222
162.248.14.107:443
90.89.95.158:2222
80.0.74.165:443
73.36.196.11:443
27.32.171.38:443
176.151.15.101:443
87.65.160.87:995
78.247.21.20:443
24.64.114.59:2078
74.93.148.97:995
82.9.210.36:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
DS.lnk
-
Size
1KB
-
MD5
4091d7118195b7b04cfe0e883bb8d0b8
-
SHA1
122d167f7f5d8ba57cb2231c1dc8954111393819
-
SHA256
3bdef21db3c0e1843d03a5458cc0f4c09bd9a06e2bc836ffab0731da0b49104f
-
SHA512
b36b8f1e5a7d8156dbcf79aecd2343a0dc3a28afcf58c9c1b92132d4d96963b04db0cf50a418007ef78e36062266827de234153d893a6c8cecb7b703acc92415
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
sandalwood/annotates.cmd
-
Size
223B
-
MD5
9bb9812540b83f5cfd7cdf25633f0426
-
SHA1
f59674e34fb3851f84b83caf8d714c82ba6f11e1
-
SHA256
de7185b7f45cfb591af1faf2496ae7498fc971b3fa6eb4c92bd0d0ffd1cc209e
-
SHA512
98de0a1200d8003cc8473b0cbd83b8612f3e751aff31e743c05fc3b30b54614f4bff8282c94eee7c21bfdb5f24b4014bb19981811e49ffd0606024bac581187a
Score1/10 -
-
-
Target
sandalwood/forthcoming.tmp
-
Size
599KB
-
MD5
80a27842055378bd905a43aca1907425
-
SHA1
a2cde02adff4b083ec91707c24bd0503c5b62985
-
SHA256
c22fee368833ff4303e6b563fe540c7759f2f4ff0102f3cb8867b30d1be5dda4
-
SHA512
26f211fab8fdfc1606a668497e8f8d3105fcb5f3ef6755b98f0702ce6dfce355d248a65b8c4eecdfbade2db789212295fb0067ac21b6608950f8b28665c47831
-
SSDEEP
12288:8PZPmBHmmHD/cJminEGEY7+wO/49T3/lSAH:uPmHRHr/0xH
Score3/10 -
-
-
Target
sandalwood/mynah.cmd
-
Size
299B
-
MD5
da182f2f18108a219f8ef565e54868e6
-
SHA1
5db854d6814cae549ab0389fa043a7b48f5d80dc
-
SHA256
f861ae19db7fb3de597e5bb2fa83fc387cda06108461b805bda8025849e04fff
-
SHA512
f18aa570d02507604a024edce17b15cb7f1e8790d7f865a54180a224ce6bcb66eeb7df9e96a1742c9b01923858c243bc750cc2f77e3b010c02364343a1da939f
Score1/10 -