General

  • Target

    3049f61dc4af5e67a37d5440bd6b782d

  • Size

    1.4MB

  • Sample

    210419-yq83s27bax

  • MD5

    3049f61dc4af5e67a37d5440bd6b782d

  • SHA1

    c94e6375ea830b19cd2ea9a78b860181de8ce46a

  • SHA256

    be26d36ef6590237c98da05310b35f03e740961b71750617f16db385aa900e61

  • SHA512

    ce32461493c87e0b138eba4a5e31db1e6f65f6e3a93ea85574b0af99d29933bd8ea001713126558717f74179f4a75c17862b82db543a2a2a2f16bb7e50f8cf78

Malware Config

Extracted

Family

qakbot

Botnet

biden29

Campaign

1618496316

C2

45.63.107.192:995

149.28.99.97:2222

75.118.1.141:443

189.210.115.207:443

72.240.200.181:2222

75.137.47.174:443

151.205.102.42:443

136.232.34.70:443

216.201.162.158:443

47.196.192.184:443

67.8.103.21:443

140.82.49.12:443

24.226.156.153:443

71.41.184.10:3389

24.139.72.117:443

71.74.12.34:443

24.55.112.61:443

173.21.10.71:2222

193.248.221.184:2222

105.198.236.99:443

Targets

    • Target

      3049f61dc4af5e67a37d5440bd6b782d

    • Size

      1.4MB

    • MD5

      3049f61dc4af5e67a37d5440bd6b782d

    • SHA1

      c94e6375ea830b19cd2ea9a78b860181de8ce46a

    • SHA256

      be26d36ef6590237c98da05310b35f03e740961b71750617f16db385aa900e61

    • SHA512

      ce32461493c87e0b138eba4a5e31db1e6f65f6e3a93ea85574b0af99d29933bd8ea001713126558717f74179f4a75c17862b82db543a2a2a2f16bb7e50f8cf78

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks