2021-10-12 Qakbot IOCs

THREAT IDENTIFICATION:  QAKBOT

SUBJECTS OBSERVED
All subjects were from stolen email threads

SENDERS OBSERVED
info@benchmarksnc.org
info@carlorussowine.com

ZIP FILE HASHES
PRMS_1773380279.zip
bab4cd2d5cb74ad659f968d741680ae6

PRMS_2004995286.zip
ed97fac83830405cedc7bdc6ff37ebab

EXCEL FILE HASHES
PRMS_2004995286.xls
36c72b93d6e9971d582828ba5830e00c

PRMS_1773380279.xls
f5a0880187fab57a1adbccf8450c154b

PAYLOAD DOWNLOAD URLS
http://185.244.150.172/44481.5188222222.dat
http://185.123.53.220/44481.5188222222.dat
http://101.99.90.219/44481.5188222222.dat

PAYLOAD FILE HASHES
44481.5188222222.dat
acdcd26de7e78893c0b6861316721469

QAKBOT C2s
https://103.148.120.144/t4
https://63.70.164.200/t4
https://68.204.7.158/t4
https://73.207.119.14/t4
https://75.131.217.182/t4