General

  • Target

    68135BC9DB57763C8800A953D52989A6.bin

  • Size

    1011KB

  • Sample

    210608-15e325snpx

  • MD5

    68135bc9db57763c8800a953d52989a6

  • SHA1

    497e7c5538ee584a70d8b3ae485effd8e96df723

  • SHA256

    44a9e4d93681d1db2df7a63a868513aa84ce0a9020b1e5a788f8d84f4f97f90d

  • SHA512

    244074f1aa05273bcd1cb805605ae530e05fa67be2389d50a04e39ddb912aa31db04ac26f988596dcc6e4a464090d8debc2a62822635288b89165f04c7120217

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

obama56

Campaign

1623057963

C2

83.110.109.189:2222

140.82.49.12:443

68.186.192.69:443

90.65.234.26:2222

190.85.91.154:443

81.97.154.100:443

86.220.62.251:2222

96.61.23.88:995

172.78.51.35:443

98.192.185.86:443

184.185.103.157:443

105.198.236.99:443

24.179.77.236:443

75.67.192.125:443

24.152.219.253:995

188.26.91.212:443

95.77.223.148:443

92.59.35.196:2222

47.22.148.6:443

149.28.98.196:443

Targets

    • Target

      68135BC9DB57763C8800A953D52989A6.bin

    • Size

      1011KB

    • MD5

      68135bc9db57763c8800a953d52989a6

    • SHA1

      497e7c5538ee584a70d8b3ae485effd8e96df723

    • SHA256

      44a9e4d93681d1db2df7a63a868513aa84ce0a9020b1e5a788f8d84f4f97f90d

    • SHA512

      244074f1aa05273bcd1cb805605ae530e05fa67be2389d50a04e39ddb912aa31db04ac26f988596dcc6e4a464090d8debc2a62822635288b89165f04c7120217

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

Tasks