General

  • Target

    46bae6e93f94d6f4cb29b7eee02d2334

  • Size

    1.0MB

  • Sample

    210614-68ecd9bpae

  • MD5

    46bae6e93f94d6f4cb29b7eee02d2334

  • SHA1

    358a439df5c25a21076fb9d708e16fe68b8ed72a

  • SHA256

    0738038e5688c3a29e00ed1ef5984df60dd70bca5603e6cf1ab37160d107fd1e

  • SHA512

    d9b6d6025beefe67dd9a64b55a0224af7f920a08a5e9be0afc2c966a4d9396b3d711e0df3937f7b53ee63959eca42915e021edcb5964a1aa97660212e10649c2

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

obama59

Campaign

1623398674

C2

105.198.236.101:443

136.232.34.70:443

45.32.211.207:995

45.32.211.207:2222

149.28.99.97:995

45.63.107.192:2222

207.246.77.75:995

149.28.99.97:443

149.28.99.97:2222

45.32.211.207:443

45.32.211.207:8443

45.63.107.192:995

45.63.107.192:443

149.28.98.196:2222

149.28.98.196:995

149.28.98.196:443

144.202.38.185:443

144.202.38.185:2222

144.202.38.185:995

149.28.101.90:443

Targets

    • Target

      46bae6e93f94d6f4cb29b7eee02d2334

    • Size

      1.0MB

    • MD5

      46bae6e93f94d6f4cb29b7eee02d2334

    • SHA1

      358a439df5c25a21076fb9d708e16fe68b8ed72a

    • SHA256

      0738038e5688c3a29e00ed1ef5984df60dd70bca5603e6cf1ab37160d107fd1e

    • SHA512

      d9b6d6025beefe67dd9a64b55a0224af7f920a08a5e9be0afc2c966a4d9396b3d711e0df3937f7b53ee63959eca42915e021edcb5964a1aa97660212e10649c2

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks