General

  • Target

    ce0d29580f965c223f635557c4dc0ac5915631b7.dll

  • Size

    2.2MB

  • Sample

    201222-rwc6abef5j

  • MD5

    14b499afc4680f4951a066d370b2704c

  • SHA1

    ce0d29580f965c223f635557c4dc0ac5915631b7

  • SHA256

    bcbd804aff1a584011f23f6f95d3dc5e59c4f2341236ec6967fa3c29699d09e6

  • SHA512

    202e901d2b14e8591b1c910a6ca5af4a60ddf93d9a58d7ce79dc2c565de2fa3e5fef3e6203dda47e772cda53643aae5524d886a3cce3698d8fe9ed5e10bcf80d

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1608026105

C2

111.95.212.237:2222

190.220.8.10:995

109.154.79.222:2222

83.110.250.71:995

149.28.99.97:2222

45.63.107.192:443

149.28.101.90:2222

149.28.101.90:995

149.28.99.97:443

149.28.98.196:443

144.202.38.185:2222

45.77.115.208:995

149.28.98.196:2222

149.28.98.196:995

149.28.99.97:995

45.63.107.192:2222

144.202.38.185:995

144.202.38.185:443

45.63.107.192:995

5.13.84.186:995

Targets

    • Target

      ce0d29580f965c223f635557c4dc0ac5915631b7.dll

    • Size

      2.2MB

    • MD5

      14b499afc4680f4951a066d370b2704c

    • SHA1

      ce0d29580f965c223f635557c4dc0ac5915631b7

    • SHA256

      bcbd804aff1a584011f23f6f95d3dc5e59c4f2341236ec6967fa3c29699d09e6

    • SHA512

      202e901d2b14e8591b1c910a6ca5af4a60ddf93d9a58d7ce79dc2c565de2fa3e5fef3e6203dda47e772cda53643aae5524d886a3cce3698d8fe9ed5e10bcf80d

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks