General

  • Target

    payload

  • Size

    590KB

  • Sample

    211007-sey4baceh2

  • MD5

    d7a942a6ae416f5efb698a7ade900d97

  • SHA1

    832375ae312906ed99a497bfdfdd90c41a3fedc6

  • SHA256

    a66ed494779ea1a013bebef1d3343a101a9722adb5c3236222d1894d9e30c28e

  • SHA512

    b245cfab0b36e16ccc8ecbf365708e518b99156d204ae167d3c817c95ed8b72d59be1972797a9b6d1ea86817a8dc29c5ec2e114da956f7ab34a396005cbcd739

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633334141

C2

75.75.179.226:443

185.250.148.74:443

122.11.220.212:2222

120.150.218.241:995

103.148.120.144:443

140.82.49.12:443

40.131.140.155:995

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.157.122.198:995

81.250.153.227:2222

167.248.100.227:443

96.57.188.174:2078

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

Targets

    • Target

      payload

    • Size

      590KB

    • MD5

      d7a942a6ae416f5efb698a7ade900d97

    • SHA1

      832375ae312906ed99a497bfdfdd90c41a3fedc6

    • SHA256

      a66ed494779ea1a013bebef1d3343a101a9722adb5c3236222d1894d9e30c28e

    • SHA512

      b245cfab0b36e16ccc8ecbf365708e518b99156d204ae167d3c817c95ed8b72d59be1972797a9b6d1ea86817a8dc29c5ec2e114da956f7ab34a396005cbcd739

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks