General

  • Target

    1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74

  • Size

    2.3MB

  • Sample

    210508-trmt778rqn

  • MD5

    5456ec2fa2f4a0c63df8111e41cf3462

  • SHA1

    d9784a94b622e7d481f2787605ca3c569eb73b31

  • SHA256

    1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74

  • SHA512

    ab6b22e74a51b747ab93192e6af985c025b03be3283e49a676d76ddc6fd17d5ed079707744627a1954c46ab2d4e0fc9355750c6f437c0016be296d99662ae801

Malware Config

Extracted

Family

qakbot

Version

324.127

Botnet

spx96

Campaign

1586873043

C2

72.209.191.27:443

173.22.120.11:2222

108.227.161.27:995

172.87.134.226:443

181.197.195.138:995

98.21.52.194:443

76.180.69.236:443

68.98.142.248:443

68.52.164.175:443

39.59.63.142:995

35.142.126.181:443

96.35.170.82:2222

75.111.145.5:443

47.214.144.253:443

74.105.139.160:443

67.8.103.21:443

50.108.212.180:443

83.25.7.201:2222

188.25.237.208:443

184.167.2.251:2222

Targets

    • Target

      1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74

    • Size

      2.3MB

    • MD5

      5456ec2fa2f4a0c63df8111e41cf3462

    • SHA1

      d9784a94b622e7d481f2787605ca3c569eb73b31

    • SHA256

      1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74

    • SHA512

      ab6b22e74a51b747ab93192e6af985c025b03be3283e49a676d76ddc6fd17d5ed079707744627a1954c46ab2d4e0fc9355750c6f437c0016be296d99662ae801

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks