General

  • Target

    Celod.wac1

  • Size

    572KB

  • Sample

    211014-rhrb7shfh6

  • MD5

    82ec0e1df076c986704fe0f919d6a53f

  • SHA1

    c0d6be6324a341c26cc36ccddf663e95104d05fc

  • SHA256

    ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

  • SHA512

    b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      Celod.wac1

    • Size

      572KB

    • MD5

      82ec0e1df076c986704fe0f919d6a53f

    • SHA1

      c0d6be6324a341c26cc36ccddf663e95104d05fc

    • SHA256

      ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

    • SHA512

      b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks