qakbot | 0e8a50ba780ca61238286a29bccf9ff7841c7eebebb2bd67ce3cc34d8ba753de

General

Target

0e8a50ba780ca61238286a29bccf9ff7841c7eebebb2bd67ce3cc34d8ba753de
Size

264KB
Sample

220213-2e2c4sdegr
MD5

35379a9a15e150a543272760ba8d2d11
SHA1

28121c059554e8a52a3450d354b858e5981700a8
SHA256

0e8a50ba780ca61238286a29bccf9ff7841c7eebebb2bd67ce3cc34d8ba753de
SHA512

89e2190c56dae71b9a60866f053010688349a8603ff517a0760b07717ad60833c346405f10fec92ed1e775956e9d935db66480f4aca660d2c95a8ff824e7527a

Score

10^/10

Malware Config

Extracted

Family

qakbot

Version

325.42

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Targets

- Target
  
  0e8a50ba780ca61238286a29bccf9ff7841c7eebebb2bd67ce3cc34d8ba753de
- Size
  
  264KB
- MD5
  
  35379a9a15e150a543272760ba8d2d11
- SHA1
  
  28121c059554e8a52a3450d354b858e5981700a8
- SHA256
  
  0e8a50ba780ca61238286a29bccf9ff7841c7eebebb2bd67ce3cc34d8ba753de
- SHA512
  
  89e2190c56dae71b9a60866f053010688349a8603ff517a0760b07717ad60833c346405f10fec92ed1e775956e9d935db66480f4aca660d2c95a8ff824e7527a
Score

10^/10
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateProcessExOtherParentProcess

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2