General

  • Target

    39b946880e4f2b9a2ba7b81a53256d0bd191650b3827525033fc07ddf159ef50

  • Size

    230KB

  • Sample

    210512-j1j3l5klma

  • MD5

    50eba5e3eadf988a741af29e55bf7ee4

  • SHA1

    1bf90a16af8c31ff3d47a16f3aceda493d146735

  • SHA256

    39b946880e4f2b9a2ba7b81a53256d0bd191650b3827525033fc07ddf159ef50

  • SHA512

    039a135a33755eb9c4dca180beee863570dbcc1858b802dd9f6ca02cf37363f8ac9d9861e2624944ef5f9b019db0102118b3435c2b28a1b1381654edafd4c803

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

tr

Campaign

1619706851

C2

24.117.107.120:443

190.85.91.154:443

72.252.201.69:443

189.210.115.207:443

71.41.184.10:3389

81.97.154.100:443

50.29.166.232:995

140.82.49.12:443

75.137.47.174:443

71.74.12.34:443

73.25.124.140:2222

149.28.99.97:2222

45.77.115.208:2222

45.32.211.207:995

207.246.116.237:443

149.28.99.97:443

207.246.77.75:443

149.28.98.196:995

207.246.116.237:2222

45.77.115.208:8443

Targets

    • Target

      39b946880e4f2b9a2ba7b81a53256d0bd191650b3827525033fc07ddf159ef50

    • Size

      230KB

    • MD5

      50eba5e3eadf988a741af29e55bf7ee4

    • SHA1

      1bf90a16af8c31ff3d47a16f3aceda493d146735

    • SHA256

      39b946880e4f2b9a2ba7b81a53256d0bd191650b3827525033fc07ddf159ef50

    • SHA512

      039a135a33755eb9c4dca180beee863570dbcc1858b802dd9f6ca02cf37363f8ac9d9861e2624944ef5f9b019db0102118b3435c2b28a1b1381654edafd4c803

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks