General

  • Target

    1312.gif

  • Size

    2.0MB

  • Sample

    210507-7jqflj4rdx

  • MD5

    ec11ad0b0b09671b0e1d33a0426fc545

  • SHA1

    f3527e4bbb1f3ea8db2365824c41cd0fac0bdf44

  • SHA256

    caf0413ce43dd36aad32438727ff41ae1b9cd3243e240a21474e606572e35712

  • SHA512

    7953df254175a8db3a16ca079bb770845bb931701ae7ff77274a2d45e26deb5e5456ecbc4053a02d65cc5b806e1442b3395075473efeb583affbeeae20e4463a

Malware Config

Extracted

Family

qakbot

Version

401.78

Botnet

tr02

Campaign

1607955641

C2

120.151.95.167:443

47.44.217.98:443

32.212.117.188:443

184.97.145.239:443

86.121.3.80:443

83.110.97.149:443

83.194.193.247:2222

105.198.236.101:443

35.134.202.234:443

189.62.175.92:22

2.89.122.157:443

78.97.207.104:443

208.93.202.41:443

45.118.216.157:443

5.204.148.208:995

5.15.226.81:443

66.26.160.37:443

84.78.128.76:2222

80.106.85.24:2222

108.31.15.10:995

Targets

    • Target

      1312.gif

    • Size

      2.0MB

    • MD5

      ec11ad0b0b09671b0e1d33a0426fc545

    • SHA1

      f3527e4bbb1f3ea8db2365824c41cd0fac0bdf44

    • SHA256

      caf0413ce43dd36aad32438727ff41ae1b9cd3243e240a21474e606572e35712

    • SHA512

      7953df254175a8db3a16ca079bb770845bb931701ae7ff77274a2d45e26deb5e5456ecbc4053a02d65cc5b806e1442b3395075473efeb583affbeeae20e4463a

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks