General

  • Target

    937f940caf972b6c393dfc47cf872a14.dll

  • Size

    1.4MB

  • Sample

    210415-fx8qmcfv1e

  • MD5

    937f940caf972b6c393dfc47cf872a14

  • SHA1

    b1255b9b6cfbd7a5a4fe316f4f47126ac5059559

  • SHA256

    5cf03d4c4ed5a25dc90ecc5b2b4624c808b901a308e1eac4881e87460eff05ab

  • SHA512

    b8f6b7d4cc9af0412a08f1c7d0002cc8d85665e696fb714af4027d532cf206868b51445a7d9f5acfcc5790754e2dc44ba0de63d28806e03f772a0b7e731e6d74

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1618225074

C2

197.45.110.165:995

216.201.162.158:443

71.74.12.34:443

45.63.107.192:2222

149.28.101.90:2222

45.32.211.207:443

45.32.211.207:995

45.32.211.207:8443

45.32.211.207:2222

149.28.99.97:995

149.28.98.196:443

149.28.101.90:443

149.28.101.90:8443

207.246.77.75:2222

207.246.116.237:443

207.246.116.237:995

207.246.116.237:2222

45.77.117.108:995

149.28.99.97:443

45.63.107.192:443

Targets

    • Target

      937f940caf972b6c393dfc47cf872a14.dll

    • Size

      1.4MB

    • MD5

      937f940caf972b6c393dfc47cf872a14

    • SHA1

      b1255b9b6cfbd7a5a4fe316f4f47126ac5059559

    • SHA256

      5cf03d4c4ed5a25dc90ecc5b2b4624c808b901a308e1eac4881e87460eff05ab

    • SHA512

      b8f6b7d4cc9af0412a08f1c7d0002cc8d85665e696fb714af4027d532cf206868b51445a7d9f5acfcc5790754e2dc44ba0de63d28806e03f772a0b7e731e6d74

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks