General

  • Target

    5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53

  • Size

    512KB

  • Sample

    211218-jv1seafdgm

  • MD5

    13dd38ab50726f4fe35fef1cdd2bac40

  • SHA1

    4b1ae77144cc52db8d9bd9502d635d8eafaee563

  • SHA256

    5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53

  • SHA512

    361d45f9aaa85eb387f2e64bad1d2868a6635f851b1e4e15e79a5bfbfd15f7243ae1783ba06f2e2f6ebd2a0e425bbda0b774a10d4a117970c277d3a75d6e9359

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

C2

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53

    • Size

      512KB

    • MD5

      13dd38ab50726f4fe35fef1cdd2bac40

    • SHA1

      4b1ae77144cc52db8d9bd9502d635d8eafaee563

    • SHA256

      5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53

    • SHA512

      361d45f9aaa85eb387f2e64bad1d2868a6635f851b1e4e15e79a5bfbfd15f7243ae1783ba06f2e2f6ebd2a0e425bbda0b774a10d4a117970c277d3a75d6e9359

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks