General

  • Target

    e9264e5385d7462278cec0d25de584e2ef9d2b30824ca2172c07f9719f1053ef

  • Size

    936KB

  • Sample

    210512-zg3ns24c1s

  • MD5

    d36b0acb6ec77a1daf5f78886587a164

  • SHA1

    2478263697b099b91e261f115d9370062ba34204

  • SHA256

    e9264e5385d7462278cec0d25de584e2ef9d2b30824ca2172c07f9719f1053ef

  • SHA512

    985223a06174c5d7147a189ca9dded055ed8564eccb49eef8bcd483402a6e76cf2259b3679d48a3db4a03a4b6ef4328f1fabbbac08e2b7c3e8edc12005eb1812

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

tr

Campaign

1619706851

C2

24.117.107.120:443

190.85.91.154:443

72.252.201.69:443

189.210.115.207:443

71.41.184.10:3389

81.97.154.100:443

50.29.166.232:995

140.82.49.12:443

75.137.47.174:443

71.74.12.34:443

73.25.124.140:2222

149.28.99.97:2222

45.77.115.208:2222

45.32.211.207:995

207.246.116.237:443

149.28.99.97:443

207.246.77.75:443

149.28.98.196:995

207.246.116.237:2222

45.77.115.208:8443

Targets

    • Target

      e9264e5385d7462278cec0d25de584e2ef9d2b30824ca2172c07f9719f1053ef

    • Size

      936KB

    • MD5

      d36b0acb6ec77a1daf5f78886587a164

    • SHA1

      2478263697b099b91e261f115d9370062ba34204

    • SHA256

      e9264e5385d7462278cec0d25de584e2ef9d2b30824ca2172c07f9719f1053ef

    • SHA512

      985223a06174c5d7147a189ca9dded055ed8564eccb49eef8bcd483402a6e76cf2259b3679d48a3db4a03a4b6ef4328f1fabbbac08e2b7c3e8edc12005eb1812

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks