General

  • Target

    894423f39835051eafd433c4d0f726f3db172520.dll

  • Size

    2.0MB

  • Sample

    201215-7tlgfdyl5x

  • MD5

    b2a9a4e1656bdb5749de4f228dc9f307

  • SHA1

    894423f39835051eafd433c4d0f726f3db172520

  • SHA256

    3984b1072731ae1a7e6f83b76e1fbbca09e0f2968d06087f2579e22edb56edc2

  • SHA512

    74b73e5afdb0ccf701a1d877e1381b1b7b6fa4a81a3b06e6021169ebb3ba936ec01c2b148aa3ee5c2344ae40c349edd0188dd85e2c874dc7f6adbc841e0768af

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1607955641

C2

120.151.95.167:443

47.44.217.98:443

32.212.117.188:443

184.97.145.239:443

86.121.3.80:443

83.110.97.149:443

83.194.193.247:2222

105.198.236.101:443

35.134.202.234:443

189.62.175.92:22

2.89.122.157:443

78.97.207.104:443

208.93.202.41:443

45.118.216.157:443

5.204.148.208:995

5.15.226.81:443

66.26.160.37:443

84.78.128.76:2222

80.106.85.24:2222

108.31.15.10:995

Targets

    • Target

      894423f39835051eafd433c4d0f726f3db172520.dll

    • Size

      2.0MB

    • MD5

      b2a9a4e1656bdb5749de4f228dc9f307

    • SHA1

      894423f39835051eafd433c4d0f726f3db172520

    • SHA256

      3984b1072731ae1a7e6f83b76e1fbbca09e0f2968d06087f2579e22edb56edc2

    • SHA512

      74b73e5afdb0ccf701a1d877e1381b1b7b6fa4a81a3b06e6021169ebb3ba936ec01c2b148aa3ee5c2344ae40c349edd0188dd85e2c874dc7f6adbc841e0768af

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks