General

  • Target

    9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b

  • Size

    805KB

  • Sample

    210224-d12dwphapj

  • MD5

    2aadd286af6533008b1b3859b7ea0036

  • SHA1

    d59b43c2b7c6c4ff56a50ae1545a045408531710

  • SHA256

    9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b

  • SHA512

    e887b4399af0c08ade01085e4f4b6d7db58e47a1b63ba7ee2fb92f787b86658a13cb2428d63ad2c686b1435d3794b2620bd878ac5f440d4598ff3bd591728891

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1612776124

C2

176.205.222.30:2078

174.76.188.217:22

105.226.10.142:443

87.202.87.210:2222

203.194.110.74:443

95.77.223.148:443

45.77.115.208:2222

47.146.169.85:443

76.94.200.148:995

23.240.70.80:443

193.252.48.200:443

154.124.130.140:995

45.32.211.207:2222

149.28.98.196:2222

149.28.98.196:995

149.28.101.90:995

207.246.77.75:2222

45.63.107.192:995

173.70.165.101:995

207.246.116.237:995

Targets

    • Target

      9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b

    • Size

      805KB

    • MD5

      2aadd286af6533008b1b3859b7ea0036

    • SHA1

      d59b43c2b7c6c4ff56a50ae1545a045408531710

    • SHA256

      9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b

    • SHA512

      e887b4399af0c08ade01085e4f4b6d7db58e47a1b63ba7ee2fb92f787b86658a13cb2428d63ad2c686b1435d3794b2620bd878ac5f440d4598ff3bd591728891

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks