forked from executemalware/Malware-IOCs
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path2021-11-01 Qakbot Campaign 2 IOCs
68 lines (54 loc) · 1.8 KB
/
2021-11-01 Qakbot Campaign 2 IOCs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
THREAT IDENTIFICATION: QAKBOT
ANALYST NOTES
I also found additional Qakbot emails from a separate campaign today.
These emails are also using stolen email threads.
A .zip file is attached to each email and each .zip file contains an .xls file.
The .xls file theme for this campaign is a white, black and blue Docusign theme.
The spreadsheet reads: "This document encrypted by DocuSign Protect Service".
In this case, the emails have a .zip file attachment which contains an .xls file.
Today, however, I was unable to get a payload.
SUBJECTS OBSERVED
All of the subjects were from stolen email threads.
SENDERS OBSERVED
ZIP FILE ATTACHMENT HASHES
CMPL-1350280706-Nov-01.zip
ac766727e813d33c495d2bec20303474
CMPL-1988482936-Nov-01.zip
d3bc4a220ef744b9abcc8b5fb643022e
CMPL-2091226883-Nov-01.zip
f2920553f8d7dd8602dbef836c7735aa
CMPL-207238559-Nov-01.zip
90fea123b4dac32519f05fe41253fff0
EXCEL FILE HASHES
CMPL-1988482936-Nov-01.xls
472fac24bc88d789ca7580da80112f4e
CMPL-207238559-Nov-01.xls
4fc07e7009e3e31abdfb2de2a9d7e20d
CMPL-2091226883-Nov-01.xls
50c8b62fc3f229ab54fa925a649bab07
CMPL-1350280706-Nov-01.xls
d37b0317b980008a81ba27dd3d35e39d
PAYLOAD DOWNLOAD URLS
http://111.90.150.195/44501.731121412.dat
http://185.106.120.116/44501.731121412.dat
http://51.89.115.115/44501.731121412.dat
PAYLOAD FILE HASHES
I was not able to download a payload.
QAKBOT C2s
I was not able to download a payload.