General

  • Target

    ktqzbif.dll

  • Size

    573KB

  • Sample

    211009-j1h5jsfbfm

  • MD5

    9cd4905d1da7ceedf81f712db42195b6

  • SHA1

    971be17d89ad0514664ac38cf969589b543080cf

  • SHA256

    497467933eb24ae13d2d8c17a785e2a723c9d488064a615d7be9fcaf659b411a

  • SHA512

    4cf4c19f8291020962dea46d9e2432b7f27cd92d233f8bc68cb68350e91276453aed7ec8479b4900202d3a8df812d5b63dbef85763c12496a62f14660da6810c

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

C2

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443

Targets

    • Target

      ktqzbif.dll

    • Size

      573KB

    • MD5

      9cd4905d1da7ceedf81f712db42195b6

    • SHA1

      971be17d89ad0514664ac38cf969589b543080cf

    • SHA256

      497467933eb24ae13d2d8c17a785e2a723c9d488064a615d7be9fcaf659b411a

    • SHA512

      4cf4c19f8291020962dea46d9e2432b7f27cd92d233f8bc68cb68350e91276453aed7ec8479b4900202d3a8df812d5b63dbef85763c12496a62f14660da6810c

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks