General

  • Target

    SecuriteInfo.com.Variant.Razy.831269.4660.10304

  • Size

    1.5MB

  • Sample

    210122-7fm8sqvdk2

  • MD5

    f33c33668bf77364beff047733ddc506

  • SHA1

    3d56f6bc71c56b73288d0a53b8ab78fe6438b533

  • SHA256

    f357cbfb4e212550d8320d0cecfcd45954a7674c423b790f432d0854b89d5ae2

  • SHA512

    9b2b24035fc753e51aed9f53d3bad044b8cde72f871f09fea871814b375e03c06e8cf0c7db96dd254cfa8cedd47d20d18e7b3ecec93d6888f44d2d6f8ca1a38c

Malware Config

Extracted

Family

qakbot

Botnet

abc119

Campaign

1611224824

C2

106.51.52.111:443

83.110.12.140:2222

89.3.198.238:443

86.220.60.133:2222

45.77.115.208:8443

45.77.115.208:995

71.117.132.169:443

82.76.47.211:443

125.63.101.62:443

86.98.93.124:2078

178.152.70.12:995

78.97.207.104:443

77.27.174.49:995

173.70.165.101:995

64.121.114.87:443

188.24.128.253:443

89.137.211.239:995

80.227.5.70:443

81.97.154.100:443

98.121.187.78:443

Targets

    • Target

      SecuriteInfo.com.Variant.Razy.831269.4660.10304

    • Size

      1.5MB

    • MD5

      f33c33668bf77364beff047733ddc506

    • SHA1

      3d56f6bc71c56b73288d0a53b8ab78fe6438b533

    • SHA256

      f357cbfb4e212550d8320d0cecfcd45954a7674c423b790f432d0854b89d5ae2

    • SHA512

      9b2b24035fc753e51aed9f53d3bad044b8cde72f871f09fea871814b375e03c06e8cf0c7db96dd254cfa8cedd47d20d18e7b3ecec93d6888f44d2d6f8ca1a38c

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks