General

  • Target

    httpd (1)

  • Size

    2.2MB

  • Sample

    201217-jzq7fxl3as

  • MD5

    3c911f8b119efefcc18cf9b385940e72

  • SHA1

    7d869469d3e3a06defae1e64244fe6678527e79a

  • SHA256

    d183c617d4a18738ee8d172cc75a867a8877f9473f40094df7a76c3b381638f3

  • SHA512

    690afb032c923edbd655675af09b70784b4a82bc337f1a24688417c9a9ffa391ec4deb9bb9d173fa7615712c0412c13d3a9d2f3125b7a3db18d34ccc31712a9d

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1608026105

C2

111.95.212.237:2222

190.220.8.10:995

109.154.79.222:2222

83.110.250.71:995

149.28.99.97:2222

45.63.107.192:443

149.28.101.90:2222

149.28.101.90:995

149.28.99.97:443

149.28.98.196:443

144.202.38.185:2222

45.77.115.208:995

149.28.98.196:2222

149.28.98.196:995

149.28.99.97:995

45.63.107.192:2222

144.202.38.185:995

144.202.38.185:443

45.63.107.192:995

5.13.84.186:995

Targets

    • Target

      httpd (1)

    • Size

      2.2MB

    • MD5

      3c911f8b119efefcc18cf9b385940e72

    • SHA1

      7d869469d3e3a06defae1e64244fe6678527e79a

    • SHA256

      d183c617d4a18738ee8d172cc75a867a8877f9473f40094df7a76c3b381638f3

    • SHA512

      690afb032c923edbd655675af09b70784b4a82bc337f1a24688417c9a9ffa391ec4deb9bb9d173fa7615712c0412c13d3a9d2f3125b7a3db18d34ccc31712a9d

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks