General

  • Target

    I200_54eff227c094b3258f9ce0338941cdc222095b5ea33b6e3265fc402f84d3df4a.bin

  • Size

    265KB

  • Sample

    211208-qfd4esdcd6

  • MD5

    63a10de4ce3bcafea85a3ef72d8d4633

  • SHA1

    e76f40e2c662026e3f3cd21c20a464eab3553139

  • SHA256

    54eff227c094b3258f9ce0338941cdc222095b5ea33b6e3265fc402f84d3df4a

  • SHA512

    d692ea8d5a3a6480df11f57e7586d69b137956454dcb775d9f57789d2f544d3272001f57106115229249eea9b91675aec0bd7d871727b177028405498f7f8140

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

obama62

Campaign

1624268905

C2

184.185.103.157:443

24.179.77.236:443

71.41.184.10:3389

95.77.223.148:443

81.97.154.100:443

105.198.236.99:443

86.220.60.247:2222

197.45.110.165:995

149.28.98.196:2222

149.28.98.196:995

149.28.101.90:443

149.28.101.90:8443

149.28.99.97:2222

45.32.211.207:995

45.63.107.192:995

45.63.107.192:443

45.63.107.192:2222

45.32.211.207:2222

207.246.77.75:8443

45.32.211.207:8443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      I200_54eff227c094b3258f9ce0338941cdc222095b5ea33b6e3265fc402f84d3df4a.bin

    • Size

      265KB

    • MD5

      63a10de4ce3bcafea85a3ef72d8d4633

    • SHA1

      e76f40e2c662026e3f3cd21c20a464eab3553139

    • SHA256

      54eff227c094b3258f9ce0338941cdc222095b5ea33b6e3265fc402f84d3df4a

    • SHA512

      d692ea8d5a3a6480df11f57e7586d69b137956454dcb775d9f57789d2f544d3272001f57106115229249eea9b91675aec0bd7d871727b177028405498f7f8140

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks