General

  • Target

    44361.6001068287.dat =^_^=

  • Size

    1.0MB

  • Sample

    210614-wxqzxafe8a

  • MD5

    0ee8cf921c45614b7d7eb7dca774b9cd

  • SHA1

    25302b3c5bfcb52de099f4193d91e246a788b978

  • SHA256

    a20ac800fb31b1c0821181ce1f06327a56e9dccf61944241ad84761c3a56cb03

  • SHA512

    f9c913b7dd349dd5bcbcc29bb9280c7e743731a8a1d2ce3c1aaf2c98e8b004581ca6298ab6fa76f97146f5eb7572022a6c433f66749c644212f4232dac18f541

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

obama59

Campaign

1623398674

C2

105.198.236.101:443

136.232.34.70:443

45.32.211.207:995

45.32.211.207:2222

149.28.99.97:995

45.63.107.192:2222

207.246.77.75:995

149.28.99.97:443

149.28.99.97:2222

45.32.211.207:443

45.32.211.207:8443

45.63.107.192:995

45.63.107.192:443

149.28.98.196:2222

149.28.98.196:995

149.28.98.196:443

144.202.38.185:443

144.202.38.185:2222

144.202.38.185:995

149.28.101.90:443

Targets

    • Target

      44361.6001068287.dat =^_^=

    • Size

      1.0MB

    • MD5

      0ee8cf921c45614b7d7eb7dca774b9cd

    • SHA1

      25302b3c5bfcb52de099f4193d91e246a788b978

    • SHA256

      a20ac800fb31b1c0821181ce1f06327a56e9dccf61944241ad84761c3a56cb03

    • SHA512

      f9c913b7dd349dd5bcbcc29bb9280c7e743731a8a1d2ce3c1aaf2c98e8b004581ca6298ab6fa76f97146f5eb7572022a6c433f66749c644212f4232dac18f541

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks