General

  • Target

    71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a

  • Size

    1.4MB

  • Sample

    210504-jafsw8xfv2

  • MD5

    92888979e33ce98460220aca2ca69582

  • SHA1

    7198cb968a60f7e6f80492e43c146865812388a2

  • SHA256

    71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a

  • SHA512

    424938a05cdcc236524abfabc47f141cb8ac0ba4df63b71b5de4657b414b679394507dcba20f8f901aba1a00334b5dd65c200d1462778152a818fcd0bc7f60b5

Malware Config

Extracted

Family

qakbot

Version

402.1

Botnet

tr

Campaign

1618225074

C2

197.45.110.165:995

216.201.162.158:443

71.74.12.34:443

45.63.107.192:2222

149.28.101.90:2222

45.32.211.207:443

45.32.211.207:995

45.32.211.207:8443

45.32.211.207:2222

149.28.99.97:995

149.28.98.196:443

149.28.101.90:443

149.28.101.90:8443

207.246.77.75:2222

207.246.116.237:443

207.246.116.237:995

207.246.116.237:2222

45.77.117.108:995

149.28.99.97:443

45.63.107.192:443

Targets

    • Target

      71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a

    • Size

      1.4MB

    • MD5

      92888979e33ce98460220aca2ca69582

    • SHA1

      7198cb968a60f7e6f80492e43c146865812388a2

    • SHA256

      71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a

    • SHA512

      424938a05cdcc236524abfabc47f141cb8ac0ba4df63b71b5de4657b414b679394507dcba20f8f901aba1a00334b5dd65c200d1462778152a818fcd0bc7f60b5

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks