General

  • Target

    8fc3671cdee9e365d46bb0a1b6fc02c8.dll

  • Size

    1.4MB

  • Sample

    210505-lfha9sw9bx

  • MD5

    8fc3671cdee9e365d46bb0a1b6fc02c8

  • SHA1

    5dc7710d25312ddf39250452478c6f03ec1734ac

  • SHA256

    3c40784862d5a82b93baaa62432b2903048c5fcfaa9d3d31cebb96ae4980ddd4

  • SHA512

    93653e557af28797d3cd9105700ef4b992f502e1dfcefad7ed98a0c271cedb2a581c82b13d3c45f4d6e849819b006d795dce8522152361ece48c1123f1a9b026

Malware Config

Extracted

Family

qakbot

Version

402.1

Botnet

tr

Campaign

1618225074

C2

197.45.110.165:995

216.201.162.158:443

71.74.12.34:443

45.63.107.192:2222

149.28.101.90:2222

45.32.211.207:443

45.32.211.207:995

45.32.211.207:8443

45.32.211.207:2222

149.28.99.97:995

149.28.98.196:443

149.28.101.90:443

149.28.101.90:8443

207.246.77.75:2222

207.246.116.237:443

207.246.116.237:995

207.246.116.237:2222

45.77.117.108:995

149.28.99.97:443

45.63.107.192:443

Targets

    • Target

      8fc3671cdee9e365d46bb0a1b6fc02c8.dll

    • Size

      1.4MB

    • MD5

      8fc3671cdee9e365d46bb0a1b6fc02c8

    • SHA1

      5dc7710d25312ddf39250452478c6f03ec1734ac

    • SHA256

      3c40784862d5a82b93baaa62432b2903048c5fcfaa9d3d31cebb96ae4980ddd4

    • SHA512

      93653e557af28797d3cd9105700ef4b992f502e1dfcefad7ed98a0c271cedb2a581c82b13d3c45f4d6e849819b006d795dce8522152361ece48c1123f1a9b026

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks