General

  • Target

    1bbeafc55ebf403a0ebbb672035e358b36377c370cd37cab7df1088c083770bf

  • Size

    1.4MB

  • Sample

    210416-8wx7nhq4ks

  • MD5

    e1335bb2eac8b5f83dd2a5e8c6815238

  • SHA1

    d8c393895cb1bf9ef55cfe252c6386376398896f

  • SHA256

    1bbeafc55ebf403a0ebbb672035e358b36377c370cd37cab7df1088c083770bf

  • SHA512

    5c2b46e598a8d7a1ba6ecee37e5ebb1713f7f96d27029335684bde0beae81e03e979cd28750baf760f35ac2e2c84322cc72c0dd72636e14fa598302399c1822c

Malware Config

Extracted

Family

qakbot

Botnet

clinton05

Campaign

1618497049

C2

72.252.201.69:443

45.63.107.192:995

149.28.99.97:2222

75.118.1.141:443

189.210.115.207:443

72.240.200.181:2222

75.137.47.174:443

151.205.102.42:443

136.232.34.70:443

216.201.162.158:443

47.196.192.184:443

67.8.103.21:443

140.82.49.12:443

24.226.156.153:443

71.41.184.10:3389

24.139.72.117:443

71.74.12.34:443

24.55.112.61:443

173.21.10.71:2222

193.248.221.184:2222

Targets

    • Target

      1bbeafc55ebf403a0ebbb672035e358b36377c370cd37cab7df1088c083770bf

    • Size

      1.4MB

    • MD5

      e1335bb2eac8b5f83dd2a5e8c6815238

    • SHA1

      d8c393895cb1bf9ef55cfe252c6386376398896f

    • SHA256

      1bbeafc55ebf403a0ebbb672035e358b36377c370cd37cab7df1088c083770bf

    • SHA512

      5c2b46e598a8d7a1ba6ecee37e5ebb1713f7f96d27029335684bde0beae81e03e979cd28750baf760f35ac2e2c84322cc72c0dd72636e14fa598302399c1822c

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks