General

  • Target

    82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49.dll

  • Size

    764KB

  • Sample

    210511-7aax68xrfa

  • MD5

    a072d40df69c27b45f993f17226c0075

  • SHA1

    5da0b7bf73bd7e37c2023d7afee50ece27d51d89

  • SHA256

    82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49

  • SHA512

    d999ef40fa3e5aeeeec9f34c4254ff9f8710969511ea3e83ead1593e47a716d2741ff0ccbc72f3eb6a4232f5f5078babe87f10aa5aa6438b16a937d592ac049a

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

tr

Campaign

1619706851

C2

24.117.107.120:443

190.85.91.154:443

72.252.201.69:443

189.210.115.207:443

71.41.184.10:3389

81.97.154.100:443

50.29.166.232:995

140.82.49.12:443

75.137.47.174:443

71.74.12.34:443

73.25.124.140:2222

149.28.99.97:2222

45.77.115.208:2222

45.32.211.207:995

207.246.116.237:443

149.28.99.97:443

207.246.77.75:443

149.28.98.196:995

207.246.116.237:2222

45.77.115.208:8443

Targets

    • Target

      82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49.dll

    • Size

      764KB

    • MD5

      a072d40df69c27b45f993f17226c0075

    • SHA1

      5da0b7bf73bd7e37c2023d7afee50ece27d51d89

    • SHA256

      82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49

    • SHA512

      d999ef40fa3e5aeeeec9f34c4254ff9f8710969511ea3e83ead1593e47a716d2741ff0ccbc72f3eb6a4232f5f5078babe87f10aa5aa6438b16a937d592ac049a

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks