General

  • Target

    fikftkm.thj

  • Size

    1.4MB

  • Sample

    210415-ymzdndn6xx

  • MD5

    f39651904de252f4e96ece7a5f844f8d

  • SHA1

    a4d212ee9cba9ae0a79582182ac4776948349541

  • SHA256

    02caf6e564c885476eded0b0558f70858a418fd8226eab2a9b79317500a471ae

  • SHA512

    6431bfb563ef1050ac58fecaf72def360003b1ec0c31e4e31eefab838ee2b8eef582025cbd20162c6f146ef29313df1dfb2bdb1b5d01bb227b638b6e8d68733e

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1618398298

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Targets

    • Target

      fikftkm.thj

    • Size

      1.4MB

    • MD5

      f39651904de252f4e96ece7a5f844f8d

    • SHA1

      a4d212ee9cba9ae0a79582182ac4776948349541

    • SHA256

      02caf6e564c885476eded0b0558f70858a418fd8226eab2a9b79317500a471ae

    • SHA512

      6431bfb563ef1050ac58fecaf72def360003b1ec0c31e4e31eefab838ee2b8eef582025cbd20162c6f146ef29313df1dfb2bdb1b5d01bb227b638b6e8d68733e

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks