General

  • Target

    97d671ec5d504466fdd5a1371de0af953208da371cc8118028fa994f2564f09a

  • Size

    361KB

  • Sample

    210224-ejwbpj35xa

  • MD5

    1c0a670426c464b5e578e267f2b0df57

  • SHA1

    394db91fa666c9ace502f2ca020ed2dd30a0fb1a

  • SHA256

    97d671ec5d504466fdd5a1371de0af953208da371cc8118028fa994f2564f09a

  • SHA512

    f2031682030e1af18b477a40ad0355c956a30bab99505a8067b8879bf9d74c8ec9829051de92c7b1e54c0228cf25a92a61c4cb3a52da84bf1a28fc21dccc3492

Malware Config

Extracted

Family

qakbot

Botnet

abc124

Campaign

1612362406

C2

86.236.77.68:2222

64.121.114.87:443

172.87.134.226:995

82.12.157.95:995

160.3.187.114:443

78.97.207.104:443

69.123.179.70:443

197.161.154.132:443

50.244.112.106:443

83.110.108.181:2222

105.198.236.99:443

74.77.162.33:443

196.151.252.84:443

140.82.49.12:443

45.118.216.157:443

80.11.173.82:8443

86.216.208.38:2222

72.240.200.181:2222

222.154.253.111:995

68.186.192.69:443

Targets

    • Target

      97d671ec5d504466fdd5a1371de0af953208da371cc8118028fa994f2564f09a

    • Size

      361KB

    • MD5

      1c0a670426c464b5e578e267f2b0df57

    • SHA1

      394db91fa666c9ace502f2ca020ed2dd30a0fb1a

    • SHA256

      97d671ec5d504466fdd5a1371de0af953208da371cc8118028fa994f2564f09a

    • SHA512

      f2031682030e1af18b477a40ad0355c956a30bab99505a8067b8879bf9d74c8ec9829051de92c7b1e54c0228cf25a92a61c4cb3a52da84bf1a28fc21dccc3492

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks