General

  • Target

    qbot

  • Size

    2.2MB

  • Sample

    210113-e9fq4bj6fs

  • MD5

    af7ab54448daab0414002cf2e871a8c1

  • SHA1

    78f66416f2527dface322a280398fad627e627fc

  • SHA256

    315c4502f7d1d792cb7b03d021d9955a96834048ea3e1d6dd0e0b13b2c51bcf6

  • SHA512

    5f49f3574b189f407107892ffbc5c08edf019101e5c6c5f4f9b36cf313fab3c0c3fca1a5ef180dbd8c7d1e4a85691817c8e344919650e7ab07534f260006f71e

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1608026105

C2

111.95.212.237:2222

190.220.8.10:995

109.154.79.222:2222

83.110.250.71:995

149.28.99.97:2222

45.63.107.192:443

149.28.101.90:2222

149.28.101.90:995

149.28.99.97:443

149.28.98.196:443

144.202.38.185:2222

45.77.115.208:995

149.28.98.196:2222

149.28.98.196:995

149.28.99.97:995

45.63.107.192:2222

144.202.38.185:995

144.202.38.185:443

45.63.107.192:995

5.13.84.186:995

Targets

    • Target

      qbot

    • Size

      2.2MB

    • MD5

      af7ab54448daab0414002cf2e871a8c1

    • SHA1

      78f66416f2527dface322a280398fad627e627fc

    • SHA256

      315c4502f7d1d792cb7b03d021d9955a96834048ea3e1d6dd0e0b13b2c51bcf6

    • SHA512

      5f49f3574b189f407107892ffbc5c08edf019101e5c6c5f4f9b36cf313fab3c0c3fca1a5ef180dbd8c7d1e4a85691817c8e344919650e7ab07534f260006f71e

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks