General

  • Target

    rober.html

  • Size

    830KB

  • Sample

    211008-nhd54aeaa5

  • MD5

    7fde788a8f37c3e61d12ca27b7536f7c

  • SHA1

    e8569185d86013fcc61755d8a61607e9fbc7b421

  • SHA256

    275f4b6bc94836a6f0d32501779dcecc57aa601d1544d71c766059e3f6b881c6

  • SHA512

    c2a270af078a765e824fbbfc7ae8fd04e30b44f1abf31e79388125c254a93b3c3606706180848cf622ba074bc12993bba2c23611a062571239f9421a84ab03d2

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Targets

    • Target

      rober.html

    • Size

      830KB

    • MD5

      7fde788a8f37c3e61d12ca27b7536f7c

    • SHA1

      e8569185d86013fcc61755d8a61607e9fbc7b421

    • SHA256

      275f4b6bc94836a6f0d32501779dcecc57aa601d1544d71c766059e3f6b881c6

    • SHA512

      c2a270af078a765e824fbbfc7ae8fd04e30b44f1abf31e79388125c254a93b3c3606706180848cf622ba074bc12993bba2c23611a062571239f9421a84ab03d2

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks