General

  • Target

    56b6151dbe9687b3cfdbebd6f841779f.dll

  • Size

    1.1MB

  • Sample

    210505-mt1e4vpn4n

  • MD5

    56b6151dbe9687b3cfdbebd6f841779f

  • SHA1

    222ac87b71d663c6c6680e677caa7d108ae3c08f

  • SHA256

    2ee8543b75bdab6cdc192a5a91e1bd8dfe6906b2e13bc4406c3d05f86d6ecedb

  • SHA512

    e84d847321b271abd43da98cbbbdd7a5db0d37b5095163fe0a973aa891e471d9332d202fac3e98e97d30a61e5a51d68d980b2fa338417cf6c883482bab655532

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

tr

Campaign

1618492267

C2

151.205.102.42:443

136.232.34.70:443

216.201.162.158:443

47.196.192.184:443

67.8.103.21:443

140.82.49.12:443

24.226.156.153:443

71.41.184.10:3389

24.139.72.117:443

71.74.12.34:443

24.55.112.61:443

173.21.10.71:2222

193.248.221.184:2222

105.198.236.99:443

78.63.226.32:443

45.63.107.192:443

149.28.98.196:443

144.202.38.185:443

149.28.101.90:995

45.32.211.207:443

Targets

    • Target

      56b6151dbe9687b3cfdbebd6f841779f.dll

    • Size

      1.1MB

    • MD5

      56b6151dbe9687b3cfdbebd6f841779f

    • SHA1

      222ac87b71d663c6c6680e677caa7d108ae3c08f

    • SHA256

      2ee8543b75bdab6cdc192a5a91e1bd8dfe6906b2e13bc4406c3d05f86d6ecedb

    • SHA512

      e84d847321b271abd43da98cbbbdd7a5db0d37b5095163fe0a973aa891e471d9332d202fac3e98e97d30a61e5a51d68d980b2fa338417cf6c883482bab655532

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks