General

  • Target

    11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78.bin

  • Size

    707KB

  • Sample

    201218-t3jge62td6

  • MD5

    4eef064479e814f52fbb93e443e61841

  • SHA1

    a687b1b13593aed25a7e51264a8980b9c8f1469e

  • SHA256

    11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78

  • SHA512

    20a3974bca03814f89a502af8f66447b7836d244e073a81454b1432dc4b280ae62f99e91d01d30c2451f69f0d3913af6409c747b112889edd8191f8c29d04673

Malware Config

Extracted

Family

qakbot

Botnet

abc115

Campaign

1608200390

C2

95.76.27.6:443

35.139.242.207:443

93.86.1.159:995

190.30.186.43:443

151.60.38.21:443

5.2.212.254:443

39.36.112.67:995

78.63.226.32:443

68.131.19.52:443

86.121.43.200:443

47.44.217.98:443

5.204.148.208:995

2.91.235.94:443

217.133.54.140:32100

86.121.3.80:443

82.76.47.211:443

5.193.148.126:2078

109.205.204.229:2222

82.12.157.95:995

45.77.115.208:2222

Targets

    • Target

      11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78.bin

    • Size

      707KB

    • MD5

      4eef064479e814f52fbb93e443e61841

    • SHA1

      a687b1b13593aed25a7e51264a8980b9c8f1469e

    • SHA256

      11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78

    • SHA512

      20a3974bca03814f89a502af8f66447b7836d244e073a81454b1432dc4b280ae62f99e91d01d30c2451f69f0d3913af6409c747b112889edd8191f8c29d04673

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks