-
Notifications
You must be signed in to change notification settings - Fork 30
/
Copy pathQakbot_AA_12.04.2022.txt
221 lines (191 loc) · 4.45 KB
/
Qakbot_AA_12.04.2022.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
12.04.2022 | Qakbot | AA | Version 403.573 | Campaign | 1649273304
******************************
.msi c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
.dll 6d8ef65670101ecf342152a34ae4b17784186759686c0e5eb631a9fa47315647
******************************
Code Signing Certificate
Organisation: P.REGO, s.r.o.
Issuer: Sectigo Public Code Signing CA R36
Algorithm: sha384WithRSAEncryption
Valid from: 2022-04-06T00:00:00Z
Valid to: 2023-04-06T23:59:59Z
Serial number: 15c21dab7f4e644e4b35c4858004d8a9
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Blocklist: This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm: SHA256
Thumbprint: 34a9cd401a5a86c5194954df3a497094c01b6603264aab5cf7d9b3c4a0074801
******************************
Exec >>
msiexec.exe /I C:\Users\******\AppData\Local\Temp\426.msi
C:\Windows\system32\msiexec.exe /V
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
MsiExec.exe -Embedding DE2EBF2BF7343DB57BA22C2CF1750165
C:\Windows\SysWOW64\regsvr32.exe C:\Users\******\AppData\Local\SetupTest\1.dll
explorer.exe
whoami /all
cmd /c set
arp -a
ipconfig /all
net view /all
nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
net share
C:\Windows\system32\net1 share
route print
netstat -nao
net localgroup
net1 localgroup
C:\Windows\system32\vssvc.exe
*************************************************
https://tria.ge/220412-vn4q9seadn
*************************************************
c2's
120.150.218.241:995
186.64.67.38:443
196.203.37.215:80
1.161.71.109:443
82.152.39.39:443
76.69.155.202:2222
72.66.116.235:995
103.107.113.120:443
113.11.89.165:995
208.107.221.224:443
103.88.226.30:443
75.99.168.194:443
75.113.214.234:2222
76.169.147.192:32103
190.73.3.148:2222
39.52.2.90:995
38.70.253.226:2222
5.95.58.211:2087
74.15.2.252:2222
76.70.9.169:2222
121.74.167.191:995
197.167.62.14:993
108.60.213.141:443
47.23.89.62:993
86.97.247.20:2222
47.23.89.62:995
176.67.56.94:443
86.98.33.251:443
96.37.113.36:993
148.64.96.100:443
47.180.172.159:443
140.82.49.12:443
80.11.74.81:2222
96.21.251.127:2222
177.158.7.155:443
125.168.47.127:2222
41.228.22.180:443
181.208.248.227:443
81.215.196.174:443
105.226.83.196:995
176.88.238.122:995
46.107.48.202:443
24.43.99.75:443
172.115.177.204:2222
180.129.102.214:995
2.50.137.197:443
78.87.206.213:995
72.76.94.99:443
66.98.42.102:443
109.228.220.196:443
75.99.168.194:61201
71.13.93.154:2222
45.9.20.200:443
173.174.216.62:443
31.35.28.29:443
93.48.80.198:995
32.221.224.140:995
203.122.46.130:443
47.180.172.159:50010
187.207.48.194:61202
39.44.144.159:995
92.132.172.197:2222
176.205.119.81:2078
144.202.2.175:995
45.76.167.26:995
149.28.238.199:995
45.76.167.26:443
144.202.2.175:443
144.202.3.39:995
45.63.1.12:995
140.82.63.183:995
144.202.3.39:443
149.28.238.199:443
45.63.1.12:443
140.82.63.183:443
63.143.92.99:995
70.46.220.114:443
103.87.95.133:2222
1.161.71.109:995
117.248.109.38:21
180.183.97.165:2222
86.97.11.43:443
202.134.152.2:2222
39.57.23.116:995
91.177.173.10:995
217.128.122.65:2222
24.178.196.158:2222
37.210.164.171:2222
37.186.54.254:995
86.98.208.214:2222
83.110.75.225:2222
174.69.215.101:443
217.165.147.83:993
172.114.160.81:995
84.241.8.23:32103
111.125.245.118:995
173.21.10.71:2222
182.191.92.203:995
191.99.191.28:443
73.151.236.31:443
119.158.121.244:995
71.74.12.34:443
101.50.103.193:995
47.158.25.67:443
187.172.232.250:443
47.156.191.217:443
187.250.114.15:443
187.195.19.24:443
201.145.189.252:443
72.252.201.34:990
72.252.201.34:995
45.46.53.140:2222
190.252.242.69:443
187.251.132.144:22
181.62.0.59:443
72.12.115.90:22
103.246.242.202:443
100.1.108.246:443
191.17.223.222:32101
40.134.246.185:995
24.55.67.176:443
109.12.111.14:443
90.120.65.153:2078
179.158.105.44:443
72.252.201.34:993
201.103.199.197:443
37.34.253.233:443
70.51.138.126:2222
187.102.135.142:2222
187.52.231.156:443
86.97.247.20:1194
41.84.242.5:995
186.105.121.166:443
31.48.166.122:2078
89.137.52.44:443
96.29.208.97:443
85.74.48.5:995
197.205.101.36:443
102.182.232.3:995
86.195.158.178:2222
217.164.210.192:443
197.89.8.167:443
201.211.64.196:2222
45.241.202.203:995
175.145.235.37:443
86.98.33.141:995
85.246.82.244:443
43.252.72.97:2222
67.209.195.198:990
41.38.167.179:995