2021-10-20 Qakbot IOCs

THREAT ATTRIBUTION:  QAKBOT

SUBJECTS OBSERVED
Email subjects are from stolen email threads

SENDERS OBSERVED
sales@techquench.com

ZIP FILE ATTACHMENT HASHES
Account-549187124.zip
62854d22db392db2c789d0a9c1dc3087

EXCEL FILE HASHES
Account-549187124.xls
b23b69b798b64ce59bb9e3b7b27367ea

PAYLOAD DOWNLOAD URLS
http://194.36.191.30/44489.4819071759.dat
http://23.106.122.40/44489.4819071759.dat
http://94.140.112.52/44489.4819071759.dat

PAYLOAD FILE HASHES
44489.4819071759.dat
86fa8ffa4ce5fceb7c0a3ec3e7f7d7b4

QAKBOT C2s
https://136.232.254.46/t4
https://24.231.209.2:2222/t4

SUPPORTING EVIDENCE
https://tria.ge/211020-r4wttaaagp