General

  • Target

    J241_6dbd9f0c642240b5ab5cc062fb64ae93b6d1f74239585b635d8e39ba75392f06.bin

  • Size

    698KB

  • Sample

    211208-qfgvbadcd7

  • MD5

    52ac9c06c3478fdc0310747be3b4f759

  • SHA1

    4f66a960eae277d6f23070ecca31f4ce8de9b108

  • SHA256

    6dbd9f0c642240b5ab5cc062fb64ae93b6d1f74239585b635d8e39ba75392f06

  • SHA512

    19bf3a51d6c26c8dfe002ed86a473319256b2caee5a8465e5b3f51b17563659235966b93434eb0664112e2461ec016213970a0666d4147d5bfbbc891a045b6e9

Malware Config

Extracted

Family

qakbot

Version

402.1

Botnet

clinton04

Campaign

1618322109

C2

75.137.47.174:443

140.82.49.12:443

151.205.102.42:443

24.226.156.153:443

24.43.22.221:993

216.201.162.158:443

76.25.142.196:443

149.28.99.97:995

149.28.101.90:2222

207.246.116.237:8443

149.28.99.97:443

45.63.107.192:2222

45.32.211.207:2222

149.28.101.90:443

45.77.117.108:995

207.246.77.75:443

207.246.77.75:8443

149.28.98.196:2222

45.32.211.207:995

45.32.211.207:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      J241_6dbd9f0c642240b5ab5cc062fb64ae93b6d1f74239585b635d8e39ba75392f06.bin

    • Size

      698KB

    • MD5

      52ac9c06c3478fdc0310747be3b4f759

    • SHA1

      4f66a960eae277d6f23070ecca31f4ce8de9b108

    • SHA256

      6dbd9f0c642240b5ab5cc062fb64ae93b6d1f74239585b635d8e39ba75392f06

    • SHA512

      19bf3a51d6c26c8dfe002ed86a473319256b2caee5a8465e5b3f51b17563659235966b93434eb0664112e2461ec016213970a0666d4147d5bfbbc891a045b6e9

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks