General

  • Target

    33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80

  • Size

    741KB

  • Sample

    211022-tb73gsbgg9

  • MD5

    f717e2f6f48ae6ee4875ef740cd4067e

  • SHA1

    cef662e43bded5848e499b5f3b506bb3829948ff

  • SHA256

    33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80

  • SHA512

    387c67166b12bb0dfa49234ffa29dda1ad08d1aefe6d67ea6cfddc184f841ed2523d8994209262af92680d7357bb1d5eca787174556184549c70efa765767990

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80

    • Size

      741KB

    • MD5

      f717e2f6f48ae6ee4875ef740cd4067e

    • SHA1

      cef662e43bded5848e499b5f3b506bb3829948ff

    • SHA256

      33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80

    • SHA512

      387c67166b12bb0dfa49234ffa29dda1ad08d1aefe6d67ea6cfddc184f841ed2523d8994209262af92680d7357bb1d5eca787174556184549c70efa765767990

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks