General

  • Target

    44487.4324564815.dat

  • Size

    689KB

  • Sample

    211018-sy8rvsegfr

  • MD5

    f29ad73459d83e444fd58cce11e7091f

  • SHA1

    7d60ffb86c9e7ffda79d648fcd61384967622e89

  • SHA256

    7d04e2a1506f4e1497e78225a34569fc5a7dbe8dfde852747fd629fdfc7ae2f9

  • SHA512

    aa1a76bf4e464e1e1be2ffd80862c1d9f2d0b37780ea47357765a983f02c5d18cb1e39f638baed00c0aa401b611bf36fb4a1d3f850961b0f92a9868a6be46301

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      44487.4324564815.dat

    • Size

      689KB

    • MD5

      f29ad73459d83e444fd58cce11e7091f

    • SHA1

      7d60ffb86c9e7ffda79d648fcd61384967622e89

    • SHA256

      7d04e2a1506f4e1497e78225a34569fc5a7dbe8dfde852747fd629fdfc7ae2f9

    • SHA512

      aa1a76bf4e464e1e1be2ffd80862c1d9f2d0b37780ea47357765a983f02c5d18cb1e39f638baed00c0aa401b611bf36fb4a1d3f850961b0f92a9868a6be46301

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks