General

  • Target

    17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7.bin

  • Size

    789KB

  • Sample

    211223-mhntvsacgm

  • MD5

    69063f91e6dfb8f69722e871d5dbf802

  • SHA1

    69530e80946049ad0637e5bee82d0932a7f2831e

  • SHA256

    17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7

  • SHA512

    c136654d600e270ef5071e7cb675d65103c353802b2f59766488d451ad72fa60dd65562580e9d6b444bd57291b12eef938f5049e86cc8e3568c198310772364a

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama149

Campaign

1640166821

C2

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

24.53.49.240:443

94.200.181.154:995

149.135.101.20:443

67.209.195.198:443

209.210.95.228:32100

96.80.109.57:995

80.14.196.176:2222

38.70.253.226:2222

24.222.20.254:443

102.65.38.67:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7.bin

    • Size

      789KB

    • MD5

      69063f91e6dfb8f69722e871d5dbf802

    • SHA1

      69530e80946049ad0637e5bee82d0932a7f2831e

    • SHA256

      17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7

    • SHA512

      c136654d600e270ef5071e7cb675d65103c353802b2f59766488d451ad72fa60dd65562580e9d6b444bd57291b12eef938f5049e86cc8e3568c198310772364a

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks