General

  • Target

    2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652

  • Size

    361KB

  • Sample

    210204-tnfllxnata

  • MD5

    bde20def51b896d6b12344760571b9b8

  • SHA1

    409e17fe79aac777d8176dd9002ee3b78fd9c37e

  • SHA256

    2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652

  • SHA512

    6f599f5beb601a5f6fc9b7dd57324ecc9776f6c9c098913f5598e66ba8fc9a9c390ba74ba3ced127b3bc89192aa2fd948a948e0d15617b429a1dba2f6de80782

Malware Config

Extracted

Family

qakbot

Botnet

abc124

Campaign

1612362406

C2

86.236.77.68:2222

64.121.114.87:443

172.87.134.226:995

82.12.157.95:995

160.3.187.114:443

78.97.207.104:443

69.123.179.70:443

197.161.154.132:443

50.244.112.106:443

83.110.108.181:2222

105.198.236.99:443

74.77.162.33:443

196.151.252.84:443

140.82.49.12:443

45.118.216.157:443

80.11.173.82:8443

86.216.208.38:2222

72.240.200.181:2222

222.154.253.111:995

68.186.192.69:443

Targets

    • Target

      2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652

    • Size

      361KB

    • MD5

      bde20def51b896d6b12344760571b9b8

    • SHA1

      409e17fe79aac777d8176dd9002ee3b78fd9c37e

    • SHA256

      2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652

    • SHA512

      6f599f5beb601a5f6fc9b7dd57324ecc9776f6c9c098913f5598e66ba8fc9a9c390ba74ba3ced127b3bc89192aa2fd948a948e0d15617b429a1dba2f6de80782

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks