General

  • Target

    a4ef2a65533b0ea25cdf8cecb5b52ae3e32df340b45a2842da2fea78d57a04fa

  • Size

    2.0MB

  • Sample

    210509-esgffwq9cx

  • MD5

    aca61e422a4d0a585e12b82d7ce05244

  • SHA1

    5baf9b89ae8df2b05543ed9b25a3badfbf6ea676

  • SHA256

    a4ef2a65533b0ea25cdf8cecb5b52ae3e32df340b45a2842da2fea78d57a04fa

  • SHA512

    f8809887d3cfbb1a9a1aeec21c29b1ba09b3e95a9b7bbab36143d6de78e1fbc92d7dfc05fe55341b11594210f5595de2d74bcfdaea73693adcde5772de87b40f

Malware Config

Extracted

Family

qakbot

Version

324.127

Botnet

spx107

Campaign

1588082813

C2

97.81.255.189:443

67.8.103.21:443

47.232.26.181:443

50.104.67.101:443

173.172.205.216:443

108.188.46.240:995

96.35.170.82:2222

70.95.94.91:2222

72.204.242.138:6881

72.231.224.122:2222

73.137.187.150:443

73.123.16.215:443

71.213.29.14:995

209.182.121.133:2222

82.210.157.185:443

69.47.26.41:443

86.122.7.89:443

71.187.170.235:443

79.113.46.93:443

74.134.4.236:443

Targets

    • Target

      a4ef2a65533b0ea25cdf8cecb5b52ae3e32df340b45a2842da2fea78d57a04fa

    • Size

      2.0MB

    • MD5

      aca61e422a4d0a585e12b82d7ce05244

    • SHA1

      5baf9b89ae8df2b05543ed9b25a3badfbf6ea676

    • SHA256

      a4ef2a65533b0ea25cdf8cecb5b52ae3e32df340b45a2842da2fea78d57a04fa

    • SHA512

      f8809887d3cfbb1a9a1aeec21c29b1ba09b3e95a9b7bbab36143d6de78e1fbc92d7dfc05fe55341b11594210f5595de2d74bcfdaea73693adcde5772de87b40f

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks