General

  • Target

    SecuriteInfo.com.Mal.EncPk-APV.26861.17707

  • Size

    1.5MB

  • Sample

    210122-a2jg2mqhwe

  • MD5

    3ed51103b766ed8816f03c753c3d0db0

  • SHA1

    4be32b59e712434095cf428b2ad211ddd8d87656

  • SHA256

    9beee380b3d74fcff2b978d7b23e8e1f5b98925bf1893647b4ed875748b6a6f0

  • SHA512

    2bc550f453545509672bc828c5e443322c951edc8cbbb0b49beb4c6196c14522c07184558a3a3e8dfd81d3de41d02e68443bbf53e4ec81cb3c133588a9729af1

Malware Config

Extracted

Family

qakbot

Botnet

abc119

Campaign

1611224824

C2

106.51.52.111:443

83.110.12.140:2222

89.3.198.238:443

86.220.60.133:2222

45.77.115.208:8443

45.77.115.208:995

71.117.132.169:443

82.76.47.211:443

125.63.101.62:443

86.98.93.124:2078

178.152.70.12:995

78.97.207.104:443

77.27.174.49:995

173.70.165.101:995

64.121.114.87:443

188.24.128.253:443

89.137.211.239:995

80.227.5.70:443

81.97.154.100:443

98.121.187.78:443

Targets

    • Target

      SecuriteInfo.com.Mal.EncPk-APV.26861.17707

    • Size

      1.5MB

    • MD5

      3ed51103b766ed8816f03c753c3d0db0

    • SHA1

      4be32b59e712434095cf428b2ad211ddd8d87656

    • SHA256

      9beee380b3d74fcff2b978d7b23e8e1f5b98925bf1893647b4ed875748b6a6f0

    • SHA512

      2bc550f453545509672bc828c5e443322c951edc8cbbb0b49beb4c6196c14522c07184558a3a3e8dfd81d3de41d02e68443bbf53e4ec81cb3c133588a9729af1

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks