General

  • Target

    e487ee74b25e8132ce00d0dc0d36f4314ef1c228762461136f65f6fb1814cd9b

  • Size

    1.8MB

  • Sample

    220201-drbq8afghn

  • MD5

    7243a21f5ceb6605f4cadd8a057129af

  • SHA1

    a28fb3a0cafa1acbc6177420c49dfd0deb4029a5

  • SHA256

    e487ee74b25e8132ce00d0dc0d36f4314ef1c228762461136f65f6fb1814cd9b

  • SHA512

    fa840675f214abc460a2e9dce35d9ae2f49b1cb4a3c2229c4a8dec23fb21bb994da042eb8e26d1577fe5682c4716c35cd63e10a915998372032e51a1731169c5

Malware Config

Extracted

Family

qakbot

Version

324.70

Botnet

spx85

Campaign

1585211304

C2

174.82.131.155:995

173.172.205.216:443

71.233.73.222:995

208.126.142.17:443

68.14.210.246:22

96.57.237.162:443

74.138.18.247:443

47.40.244.237:443

71.213.61.215:995

216.201.162.158:443

72.38.44.119:995

47.41.3.57:443

67.250.184.157:443

47.153.115.154:443

173.79.220.156:443

108.27.217.44:443

75.81.25.223:995

67.209.195.198:3389

65.30.12.240:443

66.222.88.126:995

Targets

    • Target

      e487ee74b25e8132ce00d0dc0d36f4314ef1c228762461136f65f6fb1814cd9b

    • Size

      1.8MB

    • MD5

      7243a21f5ceb6605f4cadd8a057129af

    • SHA1

      a28fb3a0cafa1acbc6177420c49dfd0deb4029a5

    • SHA256

      e487ee74b25e8132ce00d0dc0d36f4314ef1c228762461136f65f6fb1814cd9b

    • SHA512

      fa840675f214abc460a2e9dce35d9ae2f49b1cb4a3c2229c4a8dec23fb21bb994da042eb8e26d1577fe5682c4716c35cd63e10a915998372032e51a1731169c5

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks