General

  • Target

    5fef1f3e9b7584a0f6be325230fabecde15b8c2c32df2234bfb9044313aef6b4

  • Size

    2.2MB

  • Sample

    210114-jqq331xb4s

  • MD5

    9d4a2f471da76f86b2b1baab698bfb2e

  • SHA1

    a1241280ca93ad4e923aaff8269c93092a846f7a

  • SHA256

    5fef1f3e9b7584a0f6be325230fabecde15b8c2c32df2234bfb9044313aef6b4

  • SHA512

    f402a202cf79ba32f3740dbdb0627b5d94c87b4e1b59ca18369e0ef6aa2591b2870a7324fd3276e8bb4fdeac1f0b79a75eb647f0ebf0650b17585f88037b3d62

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1608026105

C2

111.95.212.237:2222

190.220.8.10:995

109.154.79.222:2222

83.110.250.71:995

149.28.99.97:2222

45.63.107.192:443

149.28.101.90:2222

149.28.101.90:995

149.28.99.97:443

149.28.98.196:443

144.202.38.185:2222

45.77.115.208:995

149.28.98.196:2222

149.28.98.196:995

149.28.99.97:995

45.63.107.192:2222

144.202.38.185:995

144.202.38.185:443

45.63.107.192:995

5.13.84.186:995

Targets

    • Target

      5fef1f3e9b7584a0f6be325230fabecde15b8c2c32df2234bfb9044313aef6b4

    • Size

      2.2MB

    • MD5

      9d4a2f471da76f86b2b1baab698bfb2e

    • SHA1

      a1241280ca93ad4e923aaff8269c93092a846f7a

    • SHA256

      5fef1f3e9b7584a0f6be325230fabecde15b8c2c32df2234bfb9044313aef6b4

    • SHA512

      f402a202cf79ba32f3740dbdb0627b5d94c87b4e1b59ca18369e0ef6aa2591b2870a7324fd3276e8bb4fdeac1f0b79a75eb647f0ebf0650b17585f88037b3d62

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks