General

  • Target

    6e3428c135d09f32938be4fa82603070e80cd829af4a678fc108e1f795f527fc

  • Size

    280KB

  • Sample

    210630-7qb3vb1vl2

  • MD5

    899644484dab4bfc0eeb4b0b7cabec93

  • SHA1

    0923e1a709832d5980f183176e3cf1e9dfe2ab08

  • SHA256

    6e3428c135d09f32938be4fa82603070e80cd829af4a678fc108e1f795f527fc

  • SHA512

    06cd92317eb2de015949cf3ed01f14142d34ff7f1cbd319a67f4cfb0f3cfe78e76fbe7222897bcb85bf4d743db36494ec16cf483e209a1ad84c48bc53d769f26

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

obama64

Campaign

1624560446

C2

140.82.49.12:443

81.214.126.173:2222

75.67.192.125:443

216.201.162.158:443

76.25.142.196:443

68.186.192.69:443

95.77.223.148:443

97.69.160.4:2222

71.41.184.10:3389

184.185.103.157:443

189.210.115.207:443

24.179.77.236:443

73.151.236.31:443

188.26.180.140:443

213.122.113.120:443

75.137.47.174:443

197.45.110.165:995

72.240.200.181:2222

75.188.35.168:443

173.21.10.71:2222

Targets

    • Target

      6e3428c135d09f32938be4fa82603070e80cd829af4a678fc108e1f795f527fc

    • Size

      280KB

    • MD5

      899644484dab4bfc0eeb4b0b7cabec93

    • SHA1

      0923e1a709832d5980f183176e3cf1e9dfe2ab08

    • SHA256

      6e3428c135d09f32938be4fa82603070e80cd829af4a678fc108e1f795f527fc

    • SHA512

      06cd92317eb2de015949cf3ed01f14142d34ff7f1cbd319a67f4cfb0f3cfe78e76fbe7222897bcb85bf4d743db36494ec16cf483e209a1ad84c48bc53d769f26

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks