General

  • Target

    7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b

  • Size

    220KB

  • Sample

    210419-qbbehnqrsa

  • MD5

    61937dd3b1410a3be02b639267ebb946

  • SHA1

    9855ac2345c63e7895ed81fc3b5bdfb74bfef82c

  • SHA256

    7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b

  • SHA512

    90759932f0d96c5b7de99b642ce5c908f9385c847d738f4144ab63b6080d072d9e839e1c0d07d3473bbf63ac7534bd4f93a23c8aef4d92593734cd1ec87861c2

Malware Config

Extracted

Family

qakbot

Botnet

obama30

Campaign

1618843418

C2

83.110.109.164:2222

75.67.192.125:443

189.210.115.207:443

47.196.192.184:443

72.252.201.69:443

151.205.102.42:443

81.97.154.100:443

24.117.107.120:443

140.82.49.12:443

78.63.226.32:443

72.240.200.181:2222

75.137.47.174:443

71.41.184.10:3389

73.25.124.140:2222

149.28.101.90:8443

149.28.101.90:2222

45.77.115.208:995

45.77.115.208:8443

207.246.77.75:8443

207.246.77.75:2222

Targets

    • Target

      7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b

    • Size

      220KB

    • MD5

      61937dd3b1410a3be02b639267ebb946

    • SHA1

      9855ac2345c63e7895ed81fc3b5bdfb74bfef82c

    • SHA256

      7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b

    • SHA512

      90759932f0d96c5b7de99b642ce5c908f9385c847d738f4144ab63b6080d072d9e839e1c0d07d3473bbf63ac7534bd4f93a23c8aef4d92593734cd1ec87861c2

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks