General

  • Target

    8f05dd46b35aa52cca1e09ce7ab7768faad1d4ad9c8b1374625890616281a800

  • Size

    1021KB

  • Sample

    210504-clzvq34y2s

  • MD5

    afded9051b57da3d5ee038ed55f1956e

  • SHA1

    e94098508736fed3f30b9d20018738859c9998b9

  • SHA256

    8f05dd46b35aa52cca1e09ce7ab7768faad1d4ad9c8b1374625890616281a800

  • SHA512

    f60eda3500235f3b84db5ab03376dda92cb0663465e833738bb60ca26dd8d9961abb73a68e6395977573b1aeff2c99e8c16ca6edc8d5ccd3b09d72b1989734cd

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

obama30

Campaign

1618843418

C2

83.110.109.164:2222

75.67.192.125:443

189.210.115.207:443

47.196.192.184:443

72.252.201.69:443

151.205.102.42:443

81.97.154.100:443

24.117.107.120:443

140.82.49.12:443

78.63.226.32:443

72.240.200.181:2222

75.137.47.174:443

71.41.184.10:3389

73.25.124.140:2222

149.28.101.90:8443

149.28.101.90:2222

45.77.115.208:995

45.77.115.208:8443

207.246.77.75:8443

207.246.77.75:2222

Targets

    • Target

      8f05dd46b35aa52cca1e09ce7ab7768faad1d4ad9c8b1374625890616281a800

    • Size

      1021KB

    • MD5

      afded9051b57da3d5ee038ed55f1956e

    • SHA1

      e94098508736fed3f30b9d20018738859c9998b9

    • SHA256

      8f05dd46b35aa52cca1e09ce7ab7768faad1d4ad9c8b1374625890616281a800

    • SHA512

      f60eda3500235f3b84db5ab03376dda92cb0663465e833738bb60ca26dd8d9961abb73a68e6395977573b1aeff2c99e8c16ca6edc8d5ccd3b09d72b1989734cd

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks