QakBot IOC's 6/12/20

QAKBOT IOCs 6/12/2020
*********************

File Writes
************
%TEMP%\dasfdsfsdf.exe - SHA256:c7933265437a80d0ab82bd9faf4de8cc817e6955bfbd22e807d79501f51b0916
%TEMP%\induce.flac - SHA256:2e491055f824bfbd934c8a134624e000ee4b1b66cbb588b2d5b3bbb3a3e86fed
%TEMP%\pep.csv - SHA256:1bc03ffe0f4848cfd0aad0aecc4e90d68e536e5dc1eee2d55b0fe0838d2718a9
%TEMP%\rhythm.tex - SHA256:c67f592c3dff363a1e7b47927e0d3e612437ac22f5ddf12d3ff4f40c8532c532
AppData\Local\Temp\senate.m4a -> (zbot) -> SHA256:3bc843b534c96a38ab8f4b785f902f70dc8ebd48164aa0870562da285c49a9ec
AppData\Local\Microsoft\Windows\INetCache\IE\GGYJG27Z\x[1].exe SHA256:fcc150c0e9e73e6422a9b5ee804914488abc213b458978a2b0afd6ac3ed8408f
AppData\Roaming\Iwhoq\pozypua.dll - SHA256:3bc843b534c96a38ab8f4b785f902f70dc8ebd48164aa0870562da285c49a9ec

Commands Run by C2
******************
%TEMP%\dasfdsfsdf.exe
cmd.exe /c net view /all /domain
cmd.exe /c net view /all
cmd.exe /c net config workstation
cmd.exe /c ipconfig /all


Network IOCs
*************
ikrbpkfrkdttyqvnyqjy[.]com
wltfhfyflpqndmlgpkfs[.]com
gswqqoydjpcxqesqtgkt[.]com
vauvdcokhmkffefcqxix[.]com
bxjbywhkvbxdgjgwwdhm[.]com
shralhojeprccnkbnhbh[.]com
bhbxjkpekewrfdrisffd[.]com
wchvuyaicmcljccwfqhy[.]com
aicmbhbxkdgjgwwdhmms[.]com
hupyuwgtjlrdrrsshhkl[.]com
wmcmbiavgkxeinxnyvnk[.]com
xflueholtjfgyubvmqhm[.]com
weksasxceoouqmlgoliy[.]com
agvcrpiaokgubykqrcsk[.]com
vimphltvuybhaicdscqm[.]com
rcsjtxvlimafwnmvfsvy[.]com
mrkqdyuxfsasjjqofqsi[.]com
hwfpteepqpqyhvssvacm[.]com
voxpfrtwwevoouavepqy[.]com
gfvqsfftoibblharmgyq[.]com
knmvfsuuculpfjeqqdse[.]com
ijokuvonleuwqrsrwrtg[.]com
wrfdsiqyshramphlkofp[.]com
cljccwfqhybhbxjkpeke[.]com
ttyqvnyqjystahydibna[.]com
nuddssajsrwsasjjqfkd[.]com
iyjysdunwbfqhyjxixrt[.]com
eboiawdoramejruvdcqx[.]com
ugihmxhyahyopmbiawgd[.]com
uadlahxpqneprholtkee[.]com
owqflgbxjbygxbomnhay[.]com
fqhykcqfvlwcypiobjqg[.]com
wsaexdig[.]pw
wpsnoum[.]pw
withifceale[.]top
leeephee[.]top
cccommercialcleaning[.]com[.]au
xeemoquo[.]top