General

  • Target

    38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0

  • Size

    839KB

  • Sample

    210511-xjeacbmqqn

  • MD5

    d36f24649f440cb0931cb3f2418a09d0

  • SHA1

    61af6abea1cc27c2dff71d90af9e06de191d7aca

  • SHA256

    38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0

  • SHA512

    b1e7c5a8178a1dfea576bb009464e5071963f398f965ff63ae3c64b7cc2c6e028f6523047615b48ef95bbad044c11c129cb58170c48fb8fb589ae50403b0c772

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

clinton13

Campaign

1620299491

C2

71.187.170.235:443

190.85.91.154:443

47.22.148.6:443

95.77.223.148:443

75.67.192.125:443

83.110.108.100:2222

81.97.154.100:443

97.69.160.4:2222

24.179.77.148:443

45.63.107.192:995

24.152.219.253:995

67.8.103.21:443

71.41.184.10:3389

184.185.103.157:443

73.25.124.140:2222

140.82.49.12:443

197.45.110.165:995

149.28.101.90:443

45.77.115.208:995

207.246.116.237:8443

Targets

    • Target

      38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0

    • Size

      839KB

    • MD5

      d36f24649f440cb0931cb3f2418a09d0

    • SHA1

      61af6abea1cc27c2dff71d90af9e06de191d7aca

    • SHA256

      38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0

    • SHA512

      b1e7c5a8178a1dfea576bb009464e5071963f398f965ff63ae3c64b7cc2c6e028f6523047615b48ef95bbad044c11c129cb58170c48fb8fb589ae50403b0c772

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks