2021-10-25 Qakbot IOCs

THREAT IDENTIFICATION:  QAKBOT

SUBJECTS OBSERVED
Email subjects were from stolen email threads.

SENDERS OBSERVED
accounting@winfieldautos.com

ZIP FILE ATTACHMENT HASHES
REF-1381025431-Oct-25.zip
87a9d9537c2b294e135ca93da5a7ed21

EXCEL FILE HASHES
REF-1381025431-Oct-25.xls
e41e82bcef0fbd1e079b3b66237e4cb8

PAYLOAD DOWNLOAD URLS
http://190.14.37.247/44494.6826158565.dat
http://51.89.115.113/44494.6826158565.dat
http://185.117.90.162/44494.6826158565.dat

PAYLOAD FILE HASHES
44494.6826158565.dat
371fb984e0651dba9b305d85ac6035fd

QAKBOT C2s
https://120.150.218.241:995/t4
https://85.226.176.123:2222/t4
https://196.207.140.40:995/t4
https://24.231.209.2:2222/t4
https://100.1.119.41/t4
https://189.218.23.60/t4
https://93.102.128.205:3389/t4
https://201.137.10.225/t4
https://103.142.10.177/t4
https://41.228.22.180/t4
https://86.97.8.178/t4
https://24.55.112.61/t4
https://109.12.111.14/t4
https://220.255.25.187:2222/t4
https://68.186.192.69/t4