General

  • Target

    39e5d2ef83627721ebd58a4bf1bd055934d21365baa094aaa95c8708f89848f3

  • Size

    741KB

  • Sample

    211022-p9asescedp

  • MD5

    8ed82c21b44fb41ccf6c2301968f16ab

  • SHA1

    d3d664b6c0e1f7e291ebcf9ec4be7af3900dd382

  • SHA256

    39e5d2ef83627721ebd58a4bf1bd055934d21365baa094aaa95c8708f89848f3

  • SHA512

    ee3541ef201f34d8b076affda43caf2c8687a2a5971a6d14935b106c496da0bbe3b335f43d42749d6a9d5e248952840b4e7e786031cfc66eb3d1cff48cd35543

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      39e5d2ef83627721ebd58a4bf1bd055934d21365baa094aaa95c8708f89848f3

    • Size

      741KB

    • MD5

      8ed82c21b44fb41ccf6c2301968f16ab

    • SHA1

      d3d664b6c0e1f7e291ebcf9ec4be7af3900dd382

    • SHA256

      39e5d2ef83627721ebd58a4bf1bd055934d21365baa094aaa95c8708f89848f3

    • SHA512

      ee3541ef201f34d8b076affda43caf2c8687a2a5971a6d14935b106c496da0bbe3b335f43d42749d6a9d5e248952840b4e7e786031cfc66eb3d1cff48cd35543

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks