General

  • Target

    f25f91576f25f4ece9e48b634db28991.dll

  • Size

    293KB

  • Sample

    201202-rnjhc8qt8x

  • MD5

    f25f91576f25f4ece9e48b634db28991

  • SHA1

    55e3eb479ccbfc51e1e67363d34a77abe8d5bc9a

  • SHA256

    e14001eb97b6f5650df3edc7270e00d4bc5f015fc0424b00d38e0a54d6ca08cb

  • SHA512

    f07d74dcd1b1b15de9e666661720e0a142b39f28dd618b7f110b9729fdbe756e6b50b401e41eef1d96a60863e53dc11bb3a143a1e0d7be5c1795d975c2eb9bbd

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1606748059

C2

197.45.110.165:995

86.99.134.235:2222

174.76.21.134:443

208.99.100.129:443

86.126.198.195:443

185.105.131.233:443

85.132.36.111:2222

105.198.236.101:443

2.49.219.254:22

217.165.2.92:995

67.6.54.180:443

5.193.115.251:2222

83.196.50.197:2222

89.3.198.238:443

94.141.3.242:443

73.239.229.107:995

217.165.15.245:2222

68.225.60.77:995

85.121.42.12:443

99.240.226.2:443

Targets

    • Target

      f25f91576f25f4ece9e48b634db28991.dll

    • Size

      293KB

    • MD5

      f25f91576f25f4ece9e48b634db28991

    • SHA1

      55e3eb479ccbfc51e1e67363d34a77abe8d5bc9a

    • SHA256

      e14001eb97b6f5650df3edc7270e00d4bc5f015fc0424b00d38e0a54d6ca08cb

    • SHA512

      f07d74dcd1b1b15de9e666661720e0a142b39f28dd618b7f110b9729fdbe756e6b50b401e41eef1d96a60863e53dc11bb3a143a1e0d7be5c1795d975c2eb9bbd

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks