General

  • Target

    44361.7134238426.dat =^_^=

  • Size

    1.0MB

  • Sample

    210614-ntqfl261pj

  • MD5

    96909c713092c0cefffcbcf809a1e412

  • SHA1

    c7d60b31b5a9180ea6cf92901924333a2cc73a85

  • SHA256

    3da2c01b64c166796491de58f1e2adbd1cd2f3a55532b4bbf38c143056e96873

  • SHA512

    1cb93847be2fc367e0a2c5956f08ba02152a4187b0500073dee65cfa741313226bd08d15e4e23b3c5a5065fd7e4932cc5a4358f9383a625d4e2d3a98bf04f608

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

obama59

Campaign

1623398674

C2

105.198.236.101:443

136.232.34.70:443

45.32.211.207:995

45.32.211.207:2222

149.28.99.97:995

45.63.107.192:2222

207.246.77.75:995

149.28.99.97:443

149.28.99.97:2222

45.32.211.207:443

45.32.211.207:8443

45.63.107.192:995

45.63.107.192:443

149.28.98.196:2222

149.28.98.196:995

149.28.98.196:443

144.202.38.185:443

144.202.38.185:2222

144.202.38.185:995

149.28.101.90:443

Targets

    • Target

      44361.7134238426.dat =^_^=

    • Size

      1.0MB

    • MD5

      96909c713092c0cefffcbcf809a1e412

    • SHA1

      c7d60b31b5a9180ea6cf92901924333a2cc73a85

    • SHA256

      3da2c01b64c166796491de58f1e2adbd1cd2f3a55532b4bbf38c143056e96873

    • SHA512

      1cb93847be2fc367e0a2c5956f08ba02152a4187b0500073dee65cfa741313226bd08d15e4e23b3c5a5065fd7e4932cc5a4358f9383a625d4e2d3a98bf04f608

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks