General
-
Target
Calculation5639.iso
-
Size
938KB
-
Sample
230127-hfr2aagf29
-
MD5
abc142e3c2853f06d4440823dfb6c325
-
SHA1
94852edd615d09955f7ffbb7e17e155b58131125
-
SHA256
97008eb4feb0f451695af9c1919780f69302d6dc01d51dbf557823a067322fdb
-
SHA512
f03db66485eac0eedafa9e57baf67a32676d492734ada0232451dea1212d865309b4e7da3522566100753a320ce9bd0641c4a6b79822b1bbb239746ba12017f2
-
SSDEEP
12288:rZBs6eUwpkdFC7dStewcZWOcRzrXugaJJkPcpFJO87YwoOEwXKPawgqwpwjOFwYr:N+UwWFew2DrkW7YwqwaywNwpw4w
Static task
static1
Behavioral task
behavioral1
Sample
Calculation.lnk
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Calculation.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
vertices/pantries.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
vertices/pantries.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
vertices/wormwood.cmd
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
vertices/wormwood.cmd
Resource
win10v2004-20220812-en
Malware Config
Extracted
qakbot
403.973
obama214
1666019778
105.96.221.136:443
37.37.80.2:3389
105.154.56.232:995
41.107.116.19:443
105.103.52.189:443
159.192.204.135:443
41.107.58.251:443
177.152.65.142:443
102.47.218.41:443
176.45.35.243:443
70.173.248.13:443
102.159.77.134:995
220.123.29.76:443
82.12.196.197:443
103.156.237.71:443
149.126.159.254:443
176.44.119.153:443
181.56.171.3:995
190.205.229.67:2222
151.251.50.117:443
163.182.177.80:443
72.21.109.1:443
41.101.92.195:443
190.193.180.228:443
190.204.112.207:2222
41.97.56.102:443
41.69.209.76:443
190.78.89.157:993
206.1.216.19:2087
85.242.200.96:443
41.251.219.50:443
105.111.141.73:443
41.103.64.82:443
190.39.218.17:443
84.220.13.28:443
190.100.149.122:995
197.1.19.60:443
196.64.70.216:443
196.89.213.40:995
181.168.145.94:443
187.101.200.186:995
41.105.245.174:443
179.25.144.177:995
78.179.135.247:443
94.52.127.44:443
186.18.210.16:443
102.158.215.180:443
78.183.238.79:443
197.1.50.150:443
42.189.32.186:80
167.58.235.5:443
14.54.83.15:443
187.198.8.241:443
71.239.12.136:443
112.70.141.221:443
37.245.136.135:2222
88.232.10.69:443
41.98.250.65:443
82.205.9.34:443
196.64.239.75:443
37.8.68.1:443
197.1.248.244:443
197.2.139.7:443
79.45.134.162:22
182.183.211.163:995
154.246.14.94:443
144.86.17.168:443
182.185.29.69:995
160.177.47.116:6881
181.197.41.173:443
160.248.194.147:443
85.109.221.97:443
125.25.77.249:995
1.20.185.138:443
91.171.72.214:32100
197.10.195.7:443
45.160.33.163:443
202.170.206.61:995
96.9.66.118:995
132.251.244.227:443
113.188.13.246:443
78.181.39.116:443
1.53.101.75:443
197.202.173.111:443
31.201.40.194:443
197.116.178.224:443
79.155.159.177:443
181.188.164.123:443
156.221.50.226:995
41.251.15.7:990
45.240.140.233:995
102.188.91.158:995
189.243.187.76:443
179.105.182.216:995
196.65.230.248:995
181.141.3.126:443
128.234.26.174:995
78.161.194.147:443
78.101.177.210:443
86.217.167.235:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Extracted
qakbot
-
salt
b�_HP&Mg�@��)U��(|�gR�b7��$L�����9,w:�X'�����]I�N} ��y�t���q� i���� Ƈ�֯�8��Z\\Ƀ�?.�ud�ڣ:� �|t\�v}�� �)�� q�L��霜k�4�6���iRr~�6eU�����?f�p,|�͵cQ��`��"p�Dz�>�o���tT�IL�z��{O퇋�V;P�oނ�G
Targets
-
-
Target
Calculation.lnk
-
Size
1KB
-
MD5
e976106196b4336440219b0275608ff7
-
SHA1
0315c08538ee1893d43927e0540abd14e0af96dc
-
SHA256
b4b3afed0916e0c32718ac2a76bff0c4680fd7b6d7334f225677a8da7334b90d
-
SHA512
80b0fc4237e095446c27321cc9f63b16d6308301d65239f5c1b16148526818bbab363b7c2d7b4482c339ab06b66e4bb854d0af1f2b51b75006e2a9e4c99402df
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
-
-
Target
vertices/pantries.asc
-
Size
584KB
-
MD5
4ccba1aae3e03bd8598b781ee11306dd
-
SHA1
8dc3fe2aed0f3a251b9efe6fa5522fee2b4605cd
-
SHA256
6aff6f1dabb7e1211a1c1726fb2ba8c0d67f580c4c4008a2082154246665f031
-
SHA512
43df8738a6220601beaabb8a19aa73d26745b444d6e0abf46f65719a3f185bdceb05141571084467fbd0c7fb1207b319761e358219386e01b4a7b995607144b9
-
SSDEEP
12288:HZBs6eUwpkdFC7dStewcZWOcRzrXugaJJkPcpF:5+UwWFew2Drk
-
-
-
Target
vertices/wormwood.cmd
-
Size
290B
-
MD5
ee164287bd040ca54021a1374b0b261c
-
SHA1
bd78bb2518b281906d2511ff0b3c30480677ee9a
-
SHA256
76b2f6d44ae7e32c24e4bde1822b6eac07e8a1ae5b7d9a2d109853875bb37030
-
SHA512
2b1e645e28d66597efde512e3f67a13b2eebf39cd612f33015655a9593e7fbe16af2ba5c7b9b0fe4dc64c68ac36b98f6975cdfe1967e962e5b3252fec499bf85
Score1/10 -