General

  • Target

    7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528

  • Size

    773KB

  • Sample

    210223-gy9btmv9es

  • MD5

    900024080a53ea49f9f7cc6ef6a07d35

  • SHA1

    323e4422e4df9606ca977a858dcd567d6ebd900c

  • SHA256

    7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528

  • SHA512

    55798f81d85ed788f55de739053e17dbbb3d5c44b3561c5477f1bad28a87f1629e0df7b48c6a076940ef876f2869ea08786678c696a100bf1587727908ffa1f1

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1612451251

C2

176.205.222.30:2078

213.60.147.140:443

45.118.216.157:443

83.110.103.152:443

108.46.145.30:443

81.150.181.168:2222

24.229.150.54:995

45.77.115.208:2222

154.125.120.87:995

50.29.166.232:995

193.252.48.200:443

67.8.103.21:443

1.32.35.2:443

85.132.36.111:2222

197.51.82.72:443

173.17.117.83:443

45.63.107.192:443

82.76.47.211:443

149.28.99.97:995

144.202.38.185:2222

Targets

    • Target

      7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528

    • Size

      773KB

    • MD5

      900024080a53ea49f9f7cc6ef6a07d35

    • SHA1

      323e4422e4df9606ca977a858dcd567d6ebd900c

    • SHA256

      7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528

    • SHA512

      55798f81d85ed788f55de739053e17dbbb3d5c44b3561c5477f1bad28a87f1629e0df7b48c6a076940ef876f2869ea08786678c696a100bf1587727908ffa1f1

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks