General

  • Target

    1634215061.dat

  • Size

    500KB

  • Sample

    211014-pt6j6ahef3

  • MD5

    5ae6f2a3c261fb2f4352c5635892e3d0

  • SHA1

    ac3ccabbc297efc42a563f75e8c9a508be39598c

  • SHA256

    8907a22252f61b0627d9c97eafcd22eb450e2a694da244e31c906a10c0d5b21f

  • SHA512

    b982a9f0e8d049c1e467f8b2aeb36a00532a755ab6e36f1e4d587d551fe94e1d8724e5d910b73edecca4fc78697d14447332ddba6c3a27878729f28eb5dd9c70

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama115

Campaign

1634197867

C2

91.178.126.51:995

220.255.25.28:2222

208.78.220.143:443

77.31.162.93:443

73.230.205.91:443

216.201.162.158:443

94.200.181.154:443

24.231.209.2:2222

89.137.52.44:443

140.82.49.12:443

65.100.174.110:32103

41.86.42.158:995

27.223.92.142:995

200.232.214.222:995

81.250.153.227:2222

217.17.56.163:465

122.60.71.201:995

120.150.218.241:995

41.228.22.180:443

69.30.186.190:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      1634215061.dat

    • Size

      500KB

    • MD5

      5ae6f2a3c261fb2f4352c5635892e3d0

    • SHA1

      ac3ccabbc297efc42a563f75e8c9a508be39598c

    • SHA256

      8907a22252f61b0627d9c97eafcd22eb450e2a694da244e31c906a10c0d5b21f

    • SHA512

      b982a9f0e8d049c1e467f8b2aeb36a00532a755ab6e36f1e4d587d551fe94e1d8724e5d910b73edecca4fc78697d14447332ddba6c3a27878729f28eb5dd9c70

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks