General

  • Target

    fjuiawhvfw.dll

  • Size

    499KB

  • Sample

    211014-vpt88aaae4

  • MD5

    db1bbe3d8d598dc88e394bddb12a5584

  • SHA1

    70c91736b6912d88e7d9c5fd0eb4f380846b06fa

  • SHA256

    b42073bdd5f620cd8de5297c81584021ad800f905f521f963b5bd9aa63d74e95

  • SHA512

    8b8a03d52facf8b3716c816d257f7fc2db7a01933a7861863fa247da0b75c5f63bdda74380bec0250e43fca44a5622b76d0e469d02fcaa23f30c5ff51066d33d

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

notset

Campaign

1632819510

C2

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      fjuiawhvfw.dll

    • Size

      499KB

    • MD5

      db1bbe3d8d598dc88e394bddb12a5584

    • SHA1

      70c91736b6912d88e7d9c5fd0eb4f380846b06fa

    • SHA256

      b42073bdd5f620cd8de5297c81584021ad800f905f521f963b5bd9aa63d74e95

    • SHA512

      8b8a03d52facf8b3716c816d257f7fc2db7a01933a7861863fa247da0b75c5f63bdda74380bec0250e43fca44a5622b76d0e469d02fcaa23f30c5ff51066d33d

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks