General

  • Target

    ad560462d9201c1668508aab714d1d8e.dll

  • Size

    347KB

  • Sample

    211012-tmx2nacgb8

  • MD5

    ad560462d9201c1668508aab714d1d8e

  • SHA1

    7d407593d270085286b22e82e07f0b6f33c23f5b

  • SHA256

    31b01b6ab814a5a6c5125f381988cc1358306d5ab1cb9c3b6602510c53fcdb9b

  • SHA512

    374bf8bb27641946518f2c8416af4f94ca1b8e40d72870b7d91e6cc651f01d05b40ef57d4f6f3e663303c52f3052e67cd9a35130252ec2a04a11532a35538dcc

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden03

Campaign

1614851222

C2

81.97.154.100:443

92.59.35.196:2222

197.161.154.132:443

75.136.26.147:443

71.117.132.169:443

78.63.226.32:443

193.248.221.184:2222

75.67.192.125:443

83.110.9.71:2222

47.22.148.6:443

89.3.198.238:443

2.232.253.79:995

45.63.107.192:2222

207.246.77.75:443

45.32.211.207:8443

207.246.77.75:8443

45.32.211.207:995

149.28.98.196:443

149.28.99.97:2222

149.28.98.196:995

Targets

    • Target

      ad560462d9201c1668508aab714d1d8e.dll

    • Size

      347KB

    • MD5

      ad560462d9201c1668508aab714d1d8e

    • SHA1

      7d407593d270085286b22e82e07f0b6f33c23f5b

    • SHA256

      31b01b6ab814a5a6c5125f381988cc1358306d5ab1cb9c3b6602510c53fcdb9b

    • SHA512

      374bf8bb27641946518f2c8416af4f94ca1b8e40d72870b7d91e6cc651f01d05b40ef57d4f6f3e663303c52f3052e67cd9a35130252ec2a04a11532a35538dcc

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks