General

  • Target

    qbot-0614.bin

  • Size

    1.0MB

  • Sample

    210614-dgzch44pyn

  • MD5

    2fc699eb45d1351b56eca349ae09638a

  • SHA1

    4b24eb640b3c2a845686a2ab0f8a5ab119faf91e

  • SHA256

    d8fc94e976e8c47d37d227fe353b60ba54c31264a08171bf59b575958b122bdc

  • SHA512

    5dc4b55547753bae7fbfd566fc0a51625022343d92e1b81b6f18a84c52c03766adac05dee2af1181049ab62575a2c752e6f907aef3fb3e77f59c1b4092a86106

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

obama59

Campaign

1623398674

C2

105.198.236.101:443

136.232.34.70:443

45.32.211.207:995

45.32.211.207:2222

149.28.99.97:995

45.63.107.192:2222

207.246.77.75:995

149.28.99.97:443

149.28.99.97:2222

45.32.211.207:443

45.32.211.207:8443

45.63.107.192:995

45.63.107.192:443

149.28.98.196:2222

149.28.98.196:995

149.28.98.196:443

144.202.38.185:443

144.202.38.185:2222

144.202.38.185:995

149.28.101.90:443

Targets

    • Target

      qbot-0614.bin

    • Size

      1.0MB

    • MD5

      2fc699eb45d1351b56eca349ae09638a

    • SHA1

      4b24eb640b3c2a845686a2ab0f8a5ab119faf91e

    • SHA256

      d8fc94e976e8c47d37d227fe353b60ba54c31264a08171bf59b575958b122bdc

    • SHA512

      5dc4b55547753bae7fbfd566fc0a51625022343d92e1b81b6f18a84c52c03766adac05dee2af1181049ab62575a2c752e6f907aef3fb3e77f59c1b4092a86106

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks