General

  • Target

    cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6

  • Size

    289KB

  • Sample

    210114-a8zp7ak2wa

  • MD5

    67ef5c7797e927b28bd49bdb72cca817

  • SHA1

    d8cfb631d79c2c198dbd74345ae12b8d804dbfc3

  • SHA256

    cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6

  • SHA512

    e3d528872dfd9b24185f319a6137184025a5d3d4917a40a06332d11bf1a671a6d95504078786322e57eb05dc7e08449f8661ba8a2496a172e1740d514e35eed5

Malware Config

Extracted

Family

qakbot

Botnet

abc104

Campaign

1606818862

C2

79.119.124.237:443

87.218.53.206:2222

181.169.88.203:443

82.12.157.95:995

94.49.188.240:443

46.124.107.124:6881

86.122.248.164:2222

83.202.68.220:2222

79.129.216.215:2222

37.21.231.245:995

47.187.49.3:2222

2.90.33.130:443

149.28.98.196:995

149.28.99.97:443

45.63.107.192:995

149.28.98.196:2222

45.63.107.192:2222

74.73.27.35:443

149.28.98.196:443

144.202.38.185:2222

Targets

    • Target

      cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6

    • Size

      289KB

    • MD5

      67ef5c7797e927b28bd49bdb72cca817

    • SHA1

      d8cfb631d79c2c198dbd74345ae12b8d804dbfc3

    • SHA256

      cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6

    • SHA512

      e3d528872dfd9b24185f319a6137184025a5d3d4917a40a06332d11bf1a671a6d95504078786322e57eb05dc7e08449f8661ba8a2496a172e1740d514e35eed5

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks