General

  • Target

    b7c87692ef9a7334e785fcdd7a29a9f2

  • Size

    736KB

  • Sample

    210621-ttytvdqn3e

  • MD5

    b7c87692ef9a7334e785fcdd7a29a9f2

  • SHA1

    675b059c8c3a3993c8472f4b6af3e219de9e005c

  • SHA256

    31c74eb44cb2a0e6be34c161926e33a66cd1cf1e4f33e6de44f9d5491a32bfb0

  • SHA512

    c5f3517351f86ef3b31b48601067e98a9881a4555f73fa685c6bc4e79e87de67e0003df3914486e3cde46f4a97b19ed5c7c37fd4d64b66a5ec88ba92bdd6e3b9

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

obama62

Campaign

1624268905

C2

184.185.103.157:443

24.179.77.236:443

71.41.184.10:3389

95.77.223.148:443

81.97.154.100:443

105.198.236.99:443

86.220.60.247:2222

197.45.110.165:995

149.28.98.196:2222

149.28.98.196:995

149.28.101.90:443

149.28.101.90:8443

149.28.99.97:2222

45.32.211.207:995

45.63.107.192:995

45.63.107.192:443

45.63.107.192:2222

45.32.211.207:2222

207.246.77.75:8443

45.32.211.207:8443

Targets

    • Target

      b7c87692ef9a7334e785fcdd7a29a9f2

    • Size

      736KB

    • MD5

      b7c87692ef9a7334e785fcdd7a29a9f2

    • SHA1

      675b059c8c3a3993c8472f4b6af3e219de9e005c

    • SHA256

      31c74eb44cb2a0e6be34c161926e33a66cd1cf1e4f33e6de44f9d5491a32bfb0

    • SHA512

      c5f3517351f86ef3b31b48601067e98a9881a4555f73fa685c6bc4e79e87de67e0003df3914486e3cde46f4a97b19ed5c7c37fd4d64b66a5ec88ba92bdd6e3b9

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks