General

  • Target

    7f2eb84749c19f521a9a1ab46fbd133e95b971c63f216a6fcf53edca62748400

  • Size

    298KB

  • Sample

    210224-642l8yejyj

  • MD5

    c2b307f0abcdbc162087c166b638786c

  • SHA1

    57ae53b15aa129791aa2745ce3bba3385f4b3759

  • SHA256

    7f2eb84749c19f521a9a1ab46fbd133e95b971c63f216a6fcf53edca62748400

  • SHA512

    64cbefaeaf917367b39d60b62ed4ab2d3381d5b7ebe1988043215e2a6ac1aae9e1e903d9cc5e732a7ebdbcd21064f1f610276cf462124b05ee5aa53cc0fe70f7

Malware Config

Extracted

Family

qakbot

Botnet

abc123

Campaign

1612275762

C2

196.151.252.84:443

216.201.162.158:443

83.110.12.140:2222

105.186.102.16:443

108.31.15.10:995

193.248.221.184:2222

68.225.60.77:995

197.45.110.165:995

89.3.198.238:443

81.97.154.100:443

81.214.126.173:2222

108.46.145.30:443

71.187.170.235:443

72.240.200.181:2222

81.88.254.62:443

98.240.24.57:443

86.97.8.249:443

75.136.40.155:443

79.129.121.81:995

37.211.90.175:995

Targets

    • Target

      7f2eb84749c19f521a9a1ab46fbd133e95b971c63f216a6fcf53edca62748400

    • Size

      298KB

    • MD5

      c2b307f0abcdbc162087c166b638786c

    • SHA1

      57ae53b15aa129791aa2745ce3bba3385f4b3759

    • SHA256

      7f2eb84749c19f521a9a1ab46fbd133e95b971c63f216a6fcf53edca62748400

    • SHA512

      64cbefaeaf917367b39d60b62ed4ab2d3381d5b7ebe1988043215e2a6ac1aae9e1e903d9cc5e732a7ebdbcd21064f1f610276cf462124b05ee5aa53cc0fe70f7

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks