General

  • Target

    9a510430c6363c9386cf4431d93cc449765e566dc637e9903c8d85eafc321398

  • Size

    777KB

  • Sample

    210402-eps2dl3css

  • MD5

    8c2a06e6a8c63f9406468048cb8da6f0

  • SHA1

    eb271cc73dfdd176fb229535c424d19e31a369ff

  • SHA256

    9a510430c6363c9386cf4431d93cc449765e566dc637e9903c8d85eafc321398

  • SHA512

    60b16001ff03b428ceb137fcb85aef91b77f6b89fa59bcb1111b3012a3345169e9ec00757a73bc703e8040cb879278ca38a4292e10fe2bed57c6259387882e5e

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1612776124

C2

176.205.222.30:2078

174.76.188.217:22

105.226.10.142:443

87.202.87.210:2222

203.194.110.74:443

95.77.223.148:443

45.77.115.208:2222

47.146.169.85:443

76.94.200.148:995

23.240.70.80:443

193.252.48.200:443

154.124.130.140:995

45.32.211.207:2222

149.28.98.196:2222

149.28.98.196:995

149.28.101.90:995

207.246.77.75:2222

45.63.107.192:995

173.70.165.101:995

207.246.116.237:995

Targets

    • Target

      9a510430c6363c9386cf4431d93cc449765e566dc637e9903c8d85eafc321398

    • Size

      777KB

    • MD5

      8c2a06e6a8c63f9406468048cb8da6f0

    • SHA1

      eb271cc73dfdd176fb229535c424d19e31a369ff

    • SHA256

      9a510430c6363c9386cf4431d93cc449765e566dc637e9903c8d85eafc321398

    • SHA512

      60b16001ff03b428ceb137fcb85aef91b77f6b89fa59bcb1111b3012a3345169e9ec00757a73bc703e8040cb879278ca38a4292e10fe2bed57c6259387882e5e

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks