General

  • Target

    60b263d5f65354a49c5e664d3ceac72dbe365a3ea9da1450e9fdf529e6d94a01

  • Size

    412KB

  • Sample

    210310-8pzxwyb8sx

  • MD5

    33e6e122d6b3f1abdfb56f2e1150f267

  • SHA1

    f2275692202ca401f934cef511ad263d90b5042a

  • SHA256

    60b263d5f65354a49c5e664d3ceac72dbe365a3ea9da1450e9fdf529e6d94a01

  • SHA512

    aba62dbe423d7dba8596446d3326da016a098c7f8d4bfe9defd72728ac716d0b5b3265a23c4314669aad755ce337803b517076e24b0d02a765eee38e2221bfdc

Malware Config

Extracted

Family

qakbot

Botnet

biden10

Campaign

1615296616

C2

79.115.174.55:443

196.151.252.84:443

24.229.150.54:995

24.117.107.120:443

106.51.85.162:443

90.65.236.181:2222

184.189.122.72:443

47.196.192.184:443

136.232.34.70:443

80.227.5.69:443

195.12.154.8:443

105.198.236.101:443

190.85.91.154:443

83.110.103.152:443

83.196.56.65:2222

24.139.72.117:443

24.55.112.61:443

47.22.148.6:443

86.220.62.251:2222

83.110.9.71:2222

Targets

    • Target

      60b263d5f65354a49c5e664d3ceac72dbe365a3ea9da1450e9fdf529e6d94a01

    • Size

      412KB

    • MD5

      33e6e122d6b3f1abdfb56f2e1150f267

    • SHA1

      f2275692202ca401f934cef511ad263d90b5042a

    • SHA256

      60b263d5f65354a49c5e664d3ceac72dbe365a3ea9da1450e9fdf529e6d94a01

    • SHA512

      aba62dbe423d7dba8596446d3326da016a098c7f8d4bfe9defd72728ac716d0b5b3265a23c4314669aad755ce337803b517076e24b0d02a765eee38e2221bfdc

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks