General

  • Target

    5386029212401664.zip

  • Size

    306KB

  • Sample

    210204-den6s5pra2

  • MD5

    9f8a79e9dddc6b07dccba8a13549fd98

  • SHA1

    6b36ad985f10ea32ec293cef2dfbf3f4d1e568b8

  • SHA256

    fc5687972d457716b560a91f67fc93243e1776f01a606eeafba88ed2d36b1924

  • SHA512

    9dcc73ad56b81b2537658cb7ffa70ee3cc2b99d4d961a1858cf7bb26b7656a9a1fdeb01c214c9133aeed5eb6052ba03099faf87cfcf08e08937bbc40ad8119c7

Malware Config

Extracted

Family

qakbot

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Targets

    • Target

      ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777

    • Size

      2.5MB

    • MD5

      66adf2e8e5561bf7cf3f3cb50d9256bf

    • SHA1

      4660be594b83147804564f04543e3ccc26dd44b9

    • SHA256

      ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777

    • SHA512

      c058776a73bc487e5c7f60b86c121ca2d1cdf19774639fe44232ce73cbf5cd91aa5b350dabcb8d6ba540f97db6f15843f6ec981ad2947bdf2d4a0b55b18f534f

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks