General

  • Target

    5925bb4f2e8eaa4144a3583ad7049164a5051a3d1d8b5b38b93119f8f1c77257

  • Size

    632KB

  • Sample

    210419-yw3kvq823s

  • MD5

    83cd1785564cd2c75f8803e244383e29

  • SHA1

    035d27997878c46abc47ccb247e1a723981913a9

  • SHA256

    5925bb4f2e8eaa4144a3583ad7049164a5051a3d1d8b5b38b93119f8f1c77257

  • SHA512

    b01951cd2317b11f2a87a9c6e388afe8be9ff523f8ed50ba87aae231bc69ebfd268b52ac94c18c5344aaec002b115b987a1664fe312c63338d2c28770503ee43

Malware Config

Extracted

Family

qakbot

Botnet

obama30

Campaign

1618843418

C2

83.110.109.164:2222

75.67.192.125:443

189.210.115.207:443

47.196.192.184:443

72.252.201.69:443

151.205.102.42:443

81.97.154.100:443

24.117.107.120:443

140.82.49.12:443

78.63.226.32:443

72.240.200.181:2222

75.137.47.174:443

71.41.184.10:3389

73.25.124.140:2222

149.28.101.90:8443

149.28.101.90:2222

45.77.115.208:995

45.77.115.208:8443

207.246.77.75:8443

207.246.77.75:2222

Targets

    • Target

      5925bb4f2e8eaa4144a3583ad7049164a5051a3d1d8b5b38b93119f8f1c77257

    • Size

      632KB

    • MD5

      83cd1785564cd2c75f8803e244383e29

    • SHA1

      035d27997878c46abc47ccb247e1a723981913a9

    • SHA256

      5925bb4f2e8eaa4144a3583ad7049164a5051a3d1d8b5b38b93119f8f1c77257

    • SHA512

      b01951cd2317b11f2a87a9c6e388afe8be9ff523f8ed50ba87aae231bc69ebfd268b52ac94c18c5344aaec002b115b987a1664fe312c63338d2c28770503ee43

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks