General

  • Target

    SecuriteInfo.com.Trojan.Win32.Save.a.32500.405

  • Size

    412KB

  • Sample

    210309-j5m1xsseqs

  • MD5

    56a9c03b5e70dc458c70726c21d2c4f2

  • SHA1

    996fe2b28604575316919075e23f6ad43ab54da1

  • SHA256

    28f9de318542ad888e2aa1759092b38017efe2c72a81b341827e71b1b9079760

  • SHA512

    732d6470a3929dfe96c599887b430e3511a8847d577e0eab829729e338f02f98bef59098915eb9294d930347eec009c041a755351bfab164c753829f708c3e4d

Malware Config

Extracted

Family

qakbot

Botnet

biden10

Campaign

1615296616

C2

79.115.174.55:443

196.151.252.84:443

24.229.150.54:995

24.117.107.120:443

106.51.85.162:443

90.65.236.181:2222

184.189.122.72:443

47.196.192.184:443

136.232.34.70:443

80.227.5.69:443

195.12.154.8:443

105.198.236.101:443

190.85.91.154:443

83.110.103.152:443

83.196.56.65:2222

24.139.72.117:443

24.55.112.61:443

47.22.148.6:443

86.220.62.251:2222

83.110.9.71:2222

Targets

    • Target

      SecuriteInfo.com.Trojan.Win32.Save.a.32500.405

    • Size

      412KB

    • MD5

      56a9c03b5e70dc458c70726c21d2c4f2

    • SHA1

      996fe2b28604575316919075e23f6ad43ab54da1

    • SHA256

      28f9de318542ad888e2aa1759092b38017efe2c72a81b341827e71b1b9079760

    • SHA512

      732d6470a3929dfe96c599887b430e3511a8847d577e0eab829729e338f02f98bef59098915eb9294d930347eec009c041a755351bfab164c753829f708c3e4d

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks