General
-
Target
944db2ee2b1958a2740d0b5c0057c46f.dll
-
Size
823KB
-
Sample
210920-v116xaefe8
-
MD5
944db2ee2b1958a2740d0b5c0057c46f
-
SHA1
b0804ed04064aed6c9b283629b3416b5aeac84fb
-
SHA256
095c41270ae3a26ae9efb626be12ed920c44432f3c8cc8ed8ee67d67425c1251
-
SHA512
786273bb4be3439fdf0f79021c043b1a95afe85444c5330ead4d93b5ad6c3484f546017e564b50b64609725df7be9071cc1eee9b3817035a36229423995b1343
Static task
static1
Behavioral task
behavioral1
Sample
944db2ee2b1958a2740d0b5c0057c46f.dll
Resource
win7-en-20210920
Malware Config
Extracted
| Family |
qakbot |
| Version |
402.318 |
| Botnet |
obama100 |
| Campaign |
1632151873 |
| C2 |
45.46.53.140:2222 144.139.47.206:443 189.210.115.207:443 120.150.218.241:995 47.22.148.6:443 140.82.49.12:443 24.139.72.117:443 24.229.150.54:995 24.55.112.61:443 136.232.34.70:443 95.77.223.148:443 173.21.10.71:2222 76.25.142.196:443 96.37.113.36:993 71.74.12.34:443 73.151.236.31:443 67.165.206.193:993 109.12.111.14:443 68.204.7.158:443 105.198.236.99:443 75.188.35.168:443 216.201.162.158:443 196.218.227.241:995 185.250.148.74:2222 81.214.126.173:2222 68.186.192.69:443 72.252.201.69:443 92.59.35.196:2222 24.152.219.253:995 50.29.166.232:995 75.67.192.125:443 24.95.61.62:443 73.25.124.140:2222 27.223.92.142:995 64.121.114.87:443 151.205.102.42:443 72.240.200.181:2222 75.137.47.174:443 45.32.211.207:995 45.32.211.207:8443 149.28.98.196:2222 149.28.98.196:995 207.246.77.75:8443 45.63.107.192:995 149.28.99.97:443 45.77.117.108:2222 149.28.99.97:2222 45.32.211.207:2222 45.63.107.192:443 149.28.101.90:443 149.28.101.90:8443 149.28.99.97:995 96.253.46.210:443 83.196.56.65:2222 45.77.115.208:2222 45.77.115.208:8443 45.77.115.208:443 144.202.38.185:443 144.202.38.185:2222 45.32.211.207:443 144.202.38.185:995 149.28.98.196:443 149.28.101.90:2222 45.77.117.108:443 207.246.77.75:995 207.246.77.75:443 207.246.77.75:2222 149.28.101.90:995 45.77.117.108:995 45.77.117.108:8443 45.77.115.208:995 71.163.222.223:443 90.87.245.154:2222 207.246.116.237:995 207.246.116.237:443 45.63.107.192:2222 207.246.116.237:8443 207.246.116.237:2222 24.179.77.236:443 184.185.103.157:443 217.165.164.110:2222 213.122.113.120:443 193.248.221.184:2222 188.27.179.172:443 222.153.169.147:995 100.2.20.137:443 172.78.42.79:443 97.69.160.4:2222 105.198.236.101:443 98.192.185.86:443 186.144.33.73:443 96.61.23.88:995 86.220.60.247:2222 71.41.184.10:3389 175.143.92.16:443 46.149.81.250:443 98.252.118.134:443 92.96.3.180:2078 71.187.170.235:443 50.244.112.106:443 24.122.118.18:443 47.196.213.73:443 186.154.175.13:443 70.163.161.79:443 78.63.226.32:443 76.168.147.166:993 77.27.207.217:995 31.4.242.28:995 125.62.192.195:443 195.12.154.8:443 96.21.251.127:2222 71.199.192.62:443 70.168.130.172:995 82.12.157.95:995 209.210.187.52:995 209.210.187.52:443 67.6.12.4:443 189.222.59.177:443 174.104.22.30:443 142.117.191.18:2222 189.146.183.105:443 213.60.147.140:443 196.221.207.137:995 108.46.145.30:443 187.250.238.164:995 2.7.116.188:2222 195.43.173.70:443 106.250.150.98:443 45.67.231.247:443 83.110.103.152:443 83.110.9.71:2222 78.97.207.104:443 59.90.246.200:443 80.227.5.69:443 125.63.101.62:443 86.236.77.68:2222 109.106.69.138:2222 84.72.35.226:443 217.133.54.140:32100 197.161.154.132:443 89.137.211.239:995 74.222.204.82:995 122.148.156.131:995 156.223.110.23:443 144.139.166.18:443 202.185.166.181:443 76.94.200.148:995 71.63.120.101:443 196.151.252.84:443 202.188.138.162:443 |
Targets
-
-
Target
944db2ee2b1958a2740d0b5c0057c46f.dll
-
Size
823KB
-
MD5
944db2ee2b1958a2740d0b5c0057c46f
-
SHA1
b0804ed04064aed6c9b283629b3416b5aeac84fb
-
SHA256
095c41270ae3a26ae9efb626be12ed920c44432f3c8cc8ed8ee67d67425c1251
-
SHA512
786273bb4be3439fdf0f79021c043b1a95afe85444c5330ead4d93b5ad6c3484f546017e564b50b64609725df7be9071cc1eee9b3817035a36229423995b1343
-
Loads dropped DLL
-
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation