General

  • Target

    5e78ab79f91d87728b002a38da7853d0304f14827be1be9675c716b2491c99c8

  • Size

    361KB

  • Sample

    210224-xttx3pzlje

  • MD5

    998faaef3ed7592143b94029384637af

  • SHA1

    e86e72cabb95f48b115cb8f1c0ee7e5a6e133651

  • SHA256

    5e78ab79f91d87728b002a38da7853d0304f14827be1be9675c716b2491c99c8

  • SHA512

    af08876056a32212d33ab4a6ba05b9c81f4f23132e8f4ea86178bc98053ca5effaa443757ef8e37195349f94dee55f55b4f9eec1619767ffa10ca2cf25565ffe

Malware Config

Extracted

Family

qakbot

Botnet

abc124

Campaign

1612362406

C2

86.236.77.68:2222

64.121.114.87:443

172.87.134.226:995

82.12.157.95:995

160.3.187.114:443

78.97.207.104:443

69.123.179.70:443

197.161.154.132:443

50.244.112.106:443

83.110.108.181:2222

105.198.236.99:443

74.77.162.33:443

196.151.252.84:443

140.82.49.12:443

45.118.216.157:443

80.11.173.82:8443

86.216.208.38:2222

72.240.200.181:2222

222.154.253.111:995

68.186.192.69:443

Targets

    • Target

      5e78ab79f91d87728b002a38da7853d0304f14827be1be9675c716b2491c99c8

    • Size

      361KB

    • MD5

      998faaef3ed7592143b94029384637af

    • SHA1

      e86e72cabb95f48b115cb8f1c0ee7e5a6e133651

    • SHA256

      5e78ab79f91d87728b002a38da7853d0304f14827be1be9675c716b2491c99c8

    • SHA512

      af08876056a32212d33ab4a6ba05b9c81f4f23132e8f4ea86178bc98053ca5effaa443757ef8e37195349f94dee55f55b4f9eec1619767ffa10ca2cf25565ffe

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks