General

  • Target

    c71ac46fba2237c4a8f62a62ce687ce1

  • Size

    890KB

  • Sample

    211021-x1hexaafe6

  • MD5

    c71ac46fba2237c4a8f62a62ce687ce1

  • SHA1

    da6f18d68a8224d84491dd7ab175c8e6588c4575

  • SHA256

    7e85568fd3f9ea14fc2a7f0f1a61499265b66001488413eaf2fd1ad86f97b05e

  • SHA512

    662c833fb3220010a0b9774e31c68a48d84c68cc3d011f2e64f8afd71bd98aac4fd7afaf5620e546ca8c1b9ede4aacb8c045d0efa18e8d94851ae30a39ae2e91

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634810637

C2

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      c71ac46fba2237c4a8f62a62ce687ce1

    • Size

      890KB

    • MD5

      c71ac46fba2237c4a8f62a62ce687ce1

    • SHA1

      da6f18d68a8224d84491dd7ab175c8e6588c4575

    • SHA256

      7e85568fd3f9ea14fc2a7f0f1a61499265b66001488413eaf2fd1ad86f97b05e

    • SHA512

      662c833fb3220010a0b9774e31c68a48d84c68cc3d011f2e64f8afd71bd98aac4fd7afaf5620e546ca8c1b9ede4aacb8c045d0efa18e8d94851ae30a39ae2e91

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks