General

  • Target

    748f51c10cfa4ca818b1528dce17e6bb4f866a9bfd498af72fa68ed9f28be554

  • Size

    843KB

  • Sample

    210218-bthns5n7h2

  • MD5

    4b136db6cbe7cf8f3f046ed8a71dea55

  • SHA1

    b7489a92ceefddfbc7f79a9c6345989e4a481877

  • SHA256

    748f51c10cfa4ca818b1528dce17e6bb4f866a9bfd498af72fa68ed9f28be554

  • SHA512

    9472e3534f61322ea24592d43d5c242284903f380141d7320439f5879ca5fe6f45243d505cd5dc74a07dc03fb1495f31ab1f73be35c9f6755e77e99b5ddca4ad

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1613385567

C2

78.63.226.32:443

197.51.82.72:443

193.248.221.184:2222

95.77.223.148:443

71.199.192.62:443

77.211.30.202:995

80.227.5.69:443

77.27.204.204:995

81.97.154.100:443

173.184.119.153:995

38.92.225.121:443

81.150.181.168:2222

90.65.236.181:2222

83.110.103.152:443

73.153.211.227:443

188.25.63.105:443

89.137.211.239:995

202.188.138.162:443

98.173.34.212:995

87.202.87.210:2222

Targets

    • Target

      748f51c10cfa4ca818b1528dce17e6bb4f866a9bfd498af72fa68ed9f28be554

    • Size

      843KB

    • MD5

      4b136db6cbe7cf8f3f046ed8a71dea55

    • SHA1

      b7489a92ceefddfbc7f79a9c6345989e4a481877

    • SHA256

      748f51c10cfa4ca818b1528dce17e6bb4f866a9bfd498af72fa68ed9f28be554

    • SHA512

      9472e3534f61322ea24592d43d5c242284903f380141d7320439f5879ca5fe6f45243d505cd5dc74a07dc03fb1495f31ab1f73be35c9f6755e77e99b5ddca4ad

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks