QakBot IOC's 08/13/2020

QAKBOT IOCs 8/13/2020
*********************

File Writes
************
13_08_2020_1660937956.doc -> SHA256: 2d586342a5ee42658960187465ce4408426a8697a1c76f4c4893e4778546dbf9
Kerpok.vb -> SHA256: 26c6a8e9ae7ce442c94e85ead16f2fa1d733fa0a917a5e40ca03bf1b2973ac50
Portes.vbs -> SHA256: 02c28308ba9e17827cabb90d9c92684658c01a52ac90106555e8d46e7fe9f696
Jorticks.cmd -> SHA256: a1a58a129f0893b4cdf8dec2616e00727a1d247d13fbcf0b9f1ca573a5aa4ccb
Loterios.exe -> SHA256:ed596b31d020b09d2c4e9b473ad72f5ef6325ab5c6a13059664ee41e1515feff (This file was PuTTY on the 08/10/2020)

Scheduled Task
***************
/Create /RU "NT AUTHORITY\SYSTEM" /tn jxwgilxk /tr "\"C:\Users\*\AppData\Local\Temp\Loterios.exe\" /I jxwgilxk" /SC ONCE

Network IOCs
*************
http[:]//accent-granit[.]com
http[:]podosenengk12[.]com
http[:]//podosenengk12[.]com/rtjyw/555555.png
http[:]//accent-granit[.]com/urjikh/555555.png
http[:]//wisedata[.]technology/xhpcvntvdmj/555555.png
http[:]//kahnamoei[.]com/vatopbv/555555.png
http[:]//carpalette-hachinohe[.]com/pdfdxenf/555555.png
http[:]//jung-versand[.]net/dbjqzkp/555555.png