General
-
Target
Malware-1.zip
-
Size
464KB
-
Sample
230505-x56nasbd21
-
MD5
8bfe9f5b7dfe730fb4a8ba7d66d0e0a3
-
SHA1
3bb27b6d2e5b3e1a7dcecd4e6e68e0639b063992
-
SHA256
dfc920de7e9fd8a1f186353f4477698f4ef985d9137b78ddb15a9365b4ddbb12
-
SHA512
36c19c697f1dca8e29475903f6b9d6ce8e40cb71cf843eee6ea0a37d21276c9f525347fd04582381a371745220a0e2f00143d901fc2122ef4c31b73d9da053b6
-
SSDEEP
12288:vaV8+hYJGklb69DDjkHcDmtBedaz5y49y:vEhwGub6Z3kHcDmtBZz5Fk
Static task
static1
Behavioral task
behavioral1
Sample
Gruellings.dll
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
Gruellings.dll
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
Gruellings.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
RunDLL-1.bat
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
RunDLL-1.bat
Resource
win7-20230220-en
Malware Config
Extracted
qakbot
404.1035
BB26
1683279184
27.109.19.90:2078
109.56.235.133:443
92.20.204.198:2222
98.145.23.67:443
50.68.204.71:995
151.55.186.41:443
12.172.173.82:21
70.28.50.223:3389
94.59.122.53:2222
12.172.173.82:32101
24.206.27.39:443
91.169.12.198:32100
12.172.173.82:993
2.82.8.80:443
104.35.24.154:443
5.30.216.183:443
50.68.204.71:443
12.172.173.82:995
103.140.174.20:2222
173.88.135.179:443
71.38.155.217:443
71.34.185.40:443
37.14.229.220:2222
70.28.50.223:1194
161.142.98.36:995
85.53.128.200:3389
24.236.90.196:2078
91.82.3.239:443
45.243.237.211:995
50.68.204.71:993
186.64.67.41:443
172.115.17.50:443
62.35.230.21:995
70.28.50.223:32100
139.226.47.229:995
103.42.86.42:995
35.143.97.145:995
31.53.29.198:2222
211.248.50.162:443
89.114.140.100:443
58.186.75.42:443
82.127.153.75:2222
109.50.128.59:2222
162.248.14.107:443
103.111.70.66:443
100.6.31.96:443
103.141.50.79:995
178.175.187.254:443
125.99.69.178:443
105.184.115.147:995
217.165.234.249:443
12.172.173.82:2087
122.184.143.85:443
69.133.162.35:443
176.142.207.63:443
74.93.148.97:995
12.172.173.82:22
184.182.66.109:443
71.78.95.86:995
70.112.206.5:443
72.134.124.16:443
81.229.117.95:2222
12.172.173.82:20
103.111.70.66:995
201.208.46.165:2222
114.143.176.235:443
103.212.19.254:995
67.10.9.125:995
99.230.89.236:2083
43.243.215.210:443
157.119.85.203:443
12.172.173.82:50001
202.184.123.13:443
77.124.5.149:443
125.99.76.102:443
96.56.197.26:2078
87.243.146.59:443
197.14.179.187:443
197.1.253.66:443
83.92.85.93:443
213.91.235.146:443
90.104.151.37:2222
123.23.65.244:443
78.192.109.105:2222
92.9.45.20:2222
188.28.72.118:443
70.28.50.223:2083
71.104.102.13:2222
122.186.210.254:443
220.240.15.200:443
41.186.88.38:443
85.104.105.67:443
87.57.13.215:443
89.79.229.50:443
2.36.64.159:2078
88.168.199.84:50000
83.114.60.6:2222
92.27.86.48:2222
50.68.186.195:443
92.188.241.102:443
96.87.28.170:2222
92.1.170.110:995
174.4.89.3:443
23.30.173.133:443
70.51.136.238:2222
68.173.170.110:8443
47.21.51.138:443
70.64.77.115:443
76.16.49.134:443
64.121.161.102:443
108.190.115.159:443
98.19.224.125:995
12.172.173.82:465
147.219.4.194:443
86.250.12.86:2222
188.176.171.3:443
88.126.94.4:50000
87.202.101.164:50000
74.92.243.115:50000
98.176.5.56:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
Gruellings.englishedDuctal
-
Size
914KB
-
MD5
523cc56138abe3130a12aad573771714
-
SHA1
8daed7acb98e3f055f1bed5a0d355a4a225f4c33
-
SHA256
c52ba47d8a0aa3ba7829b0880ee17001f1a75b2988434ea8eb8e7a5ea8e5e3d7
-
SHA512
479968fc5ffacd1f61c6f58ed03e6561bb007c4c8e985b98d20178e12d38b9a05d34e0818be214f56c5b178bc383f52c1b17feb8066952e70c6a79803925f83b
-
SSDEEP
24576:xHA2XMYABs772W/8vLj/9sgR+OVnh8gt42vCkzeztwPOfQWyBZPPdhbBF91Xe9a:FMYABC8vLj/2jA8gxZPPdhbBP1O9a
Score3/10 -
-
-
Target
RunDLL-1.bat
-
Size
44B
-
MD5
f3a42431a41293fa888a61f615b70772
-
SHA1
0c5db8e1f6d9f04109220c19b90e4fe7bbb931d3
-
SHA256
66532c454244a439141008a2ffac93f9996a9c565a884c7f47d8a7357964293f
-
SHA512
ddc9b32109f0be1b895be566820a90a48b4274334d0a4d911adf67347176ce9f05511effd27c8498179f9b2b6d7458e467768dceafe74c557ce3d53bce2ea19b
-
Blocklisted process makes network request
-