General

  • Target

    cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dll

  • Size

    909KB

  • Sample

    210507-3mjmp2snrj

  • MD5

    ee0a11ed10588b6c7c35b6a36f0998da

  • SHA1

    21e0eb33704b6dcf2e1899d90d6600a5db60e864

  • SHA256

    cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80

  • SHA512

    e5319309a939ab8be761b94247e8f196a315f0e8bf66d1e31a94bde2f853dbc5143a2a2906ba0c0f2ef6f652e761de8befb78f545e6ea59aae9222e87fb4ec20

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

domain02

Campaign

1613028094

C2

32.210.98.6:443

70.49.88.199:2222

151.205.102.42:443

178.152.79.153:995

216.195.46.163:2222

72.252.201.69:443

90.65.236.181:2222

98.173.34.212:995

97.69.160.4:2222

69.245.102.225:443

144.139.166.18:443

73.25.124.140:2222

189.223.205.126:443

157.131.108.180:443

71.197.126.250:443

73.228.197.5:443

151.213.189.62:443

24.229.150.54:995

84.72.35.226:443

199.19.117.131:443

Targets

    • Target

      cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dll

    • Size

      909KB

    • MD5

      ee0a11ed10588b6c7c35b6a36f0998da

    • SHA1

      21e0eb33704b6dcf2e1899d90d6600a5db60e864

    • SHA256

      cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80

    • SHA512

      e5319309a939ab8be761b94247e8f196a315f0e8bf66d1e31a94bde2f853dbc5143a2a2906ba0c0f2ef6f652e761de8befb78f545e6ea59aae9222e87fb4ec20

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks