General

  • Target

    b30a9756fc8900761f35be12a3db9a178b06ba9afc01219b8323814048982807

  • Size

    2.0MB

  • Sample

    220205-m9pkgaahhr

  • MD5

    3a0cfebaeeb1348f034ea8996b436c2f

  • SHA1

    4c2ebf3f0eb5c92c6bd0aced9b9a586ae75424f5

  • SHA256

    b30a9756fc8900761f35be12a3db9a178b06ba9afc01219b8323814048982807

  • SHA512

    26c5f1dc768491aafdbcc6618f14e4aa4962465dbb2b3d10d1373485eb4082cbef320fe7c33be6624807a688e354d9a406bf911082759fa217ed9d95a1f4a104

Malware Config

Extracted

Family

qakbot

Version

324.127

Botnet

spx106

Campaign

1588083274

C2

5.2.149.216:443

5.182.39.156:443

156.222.184.101:995

208.126.142.17:443

108.21.54.174:443

74.129.26.223:443

72.204.242.138:443

87.65.204.240:995

136.228.103.44:443

92.114.85.210:995

184.180.157.203:2222

72.142.106.198:995

151.205.102.42:443

172.78.181.79:443

72.181.15.240:443

186.29.97.27:443

98.243.187.85:443

137.99.224.198:443

108.21.107.203:443

97.81.255.189:443

Targets

    • Target

      b30a9756fc8900761f35be12a3db9a178b06ba9afc01219b8323814048982807

    • Size

      2.0MB

    • MD5

      3a0cfebaeeb1348f034ea8996b436c2f

    • SHA1

      4c2ebf3f0eb5c92c6bd0aced9b9a586ae75424f5

    • SHA256

      b30a9756fc8900761f35be12a3db9a178b06ba9afc01219b8323814048982807

    • SHA512

      26c5f1dc768491aafdbcc6618f14e4aa4962465dbb2b3d10d1373485eb4082cbef320fe7c33be6624807a688e354d9a406bf911082759fa217ed9d95a1f4a104

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks